Issue 5382 - Wrap DOM mutation APIs to protect frames

inject.preload.js

Index: inject.preload.js
===================================================================
--- a/inject.preload.js
+++ b/inject.preload.js
@@ -67,16 +67,41 @@
           "(" + injectedToString() + ")('" + eventName + "', true);"
         );
         delete contentWindow[eventName];
       }
       catch (e) {}
     }
   }
 
+  function wrapAPIForIFrame(object, api)
+  {
+    let func = object[api];
+    object[api] = function(...args)
+    {
+      let returnValue = func.apply(this, args);
+      for (let i = 0; i < window.length; i++)
+        injectIntoContentWindow(window[i]);
+      return returnValue;
+    };
+  }
+
+  function wrapPropertyAPIForIFrame(object, api)
+  {
+    let descriptor = Object.getOwnPropertyDescriptor(object, api);
+    wrapAPIForIFrame(descriptor, "set");
+    Object.defineProperty(object, api, descriptor);
+  }
+
+  wrapAPIForIFrame(Node.prototype, "appendChild");
+  wrapAPIForIFrame(Node.prototype, "insertBefore");
+  wrapAPIForIFrame(Node.prototype, "replaceChild");
+
+  wrapPropertyAPIForIFrame(Element.prototype, "innerHTML");
+
   for (let element of [HTMLFrameElement, HTMLIFrameElement, HTMLObjectElement])
   {
     let contentDocumentDesc = Object.getOwnPropertyDescriptor(
       element.prototype, "contentDocument"
     );
     let contentWindowDesc = Object.getOwnPropertyDescriptor(
       element.prototype, "contentWindow"
     );