From bcfc96cd62a846fe6d4d25edd27e20ebe9b1cda8 Mon Sep 17 00:00:00 2001
From: Kuitos <kuitos.lau@gmail.com>
Date: Mon, 27 Feb 2023 22:06:41 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20compatible=20with=20nested=20san?=
 =?UTF-8?q?dbox=20to=20avoid=20stack=20overflow=20while=20createElement=20?=
 =?UTF-8?q?calling=20(#2414)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/sandbox/patchers/dynamicAppend/forStrictSandbox.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/sandbox/patchers/dynamicAppend/forStrictSandbox.ts b/src/sandbox/patchers/dynamicAppend/forStrictSandbox.ts
index ae4a876..1208f01 100644
--- a/src/sandbox/patchers/dynamicAppend/forStrictSandbox.ts
+++ b/src/sandbox/patchers/dynamicAppend/forStrictSandbox.ts
@@ -50,8 +50,10 @@ function patchDocument(cfg: { sandbox: SandBox; speedy: boolean }) {
       },
       get: (target, p) => {
         if (p === 'createElement') {
-          return (...args: Parameters<typeof document.createElement>) => {
-            const element = document.createElement(...args);
+          // Must store the original createElement function to avoid error in nested sandbox
+          const targetCreateElement = target.createElement;
+          return function createElement(...args: Parameters<typeof document.createElement>) {
+            const element = targetCreateElement.call(target, ...args);
             attachElementToProxy(element, sandbox.proxy);
             return element;
           };