guawazi/qiankun-fit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

🐛 createElement hijack must be paired to avoid rewriting leak (#2777)

Browse Source
This commit is contained in:
Kuitos 2023-11-02 21:13:16 +08:00 committed by GitHub
parent 46e492156e
commit a38b1af97f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/sandbox/patchers/dynamicAppend/forStrictSandbox.ts
View File

@ -59,16 +59,37 @@ function patchDocument(cfg: { sandbox: SandBox; speedy: boolean }) {
}; };
if (speedy) { if (speedy) {
const modifications: {
createElement?: typeof document.createElement;
querySelector?: typeof document.querySelector;
} = {};
const proxyDocument = new Proxy(document, { const proxyDocument = new Proxy(document, {
/**
* Read and write must be paired, otherwise the write operation will leak to the global
*/
set: (target, p, value) => { set: (target, p, value) => {
(<any>target)[p] = value; switch (p) {
case 'createElement': {
modifications.createElement = value;
break;
}
case 'querySelector': {
modifications.querySelector = value;
break;
}
default:
(<any>target)[p] = value;
break;
}
return true; return true;
}, },
get: (target, p, receiver) => { get: (target, p, receiver) => {
switch (p) { switch (p) {
case 'createElement': { case 'createElement': {
// Must store the original createElement function to avoid error in nested sandbox // Must store the original createElement function to avoid error in nested sandbox
const targetCreateElement = target.createElement; const targetCreateElement = modifications.createElement || target.createElement;
return function createElement(...args: Parameters<typeof document.createElement>) { return function createElement(...args: Parameters<typeof document.createElement>) {
if (!nativeGlobal.__currentLockingSandbox__) { if (!nativeGlobal.__currentLockingSandbox__) {
nativeGlobal.__currentLockingSandbox__ = sandbox.name; nativeGlobal.__currentLockingSandbox__ = sandbox.name;
@ -87,7 +108,7 @@ function patchDocument(cfg: { sandbox: SandBox; speedy: boolean }) {
} }
case 'querySelector': { case 'querySelector': {
const targetQuerySelector = target.querySelector; const targetQuerySelector = modifications.querySelector || target.querySelector;
return function querySelector(...args: Parameters<typeof document.querySelector>) { return function querySelector(...args: Parameters<typeof document.querySelector>) {
const selector = args[0]; const selector = args[0];
switch (selector) { switch (selector) {