Harden Snow iframes clashing and protection - Githubissues

LavaMoat / snow

Use Snow to finally secure your web app's same origin realms!

https://lavamoat.github.io/snow/demo/

MIT License

100 stars 9 forks source link

Harden Snow iframes clashing and protection #128

Closed weizman closed 1 year ago

weizman commented 1 year ago

This PR continues:

97 - making sure there is not clash between Snow instance on top and Snow instance on inner same origin LOADED iframes
73 - hardening protection against #73 vuln

Context goes further in fix attempts #121 and #124, this PR is an extension of the attempt done in #124 mostly, by:

making sure "skip" is only relevant to the top and not all windows
making sure passing the correct window to top.SNOW actually happens