LavaMoat / snow

Use Snow to finally secure your web app's same origin realms!
https://lavamoat.github.io/snow/demo/
MIT License
102 stars 9 forks source link

Hooks for "addEventListener" and "removeEventListener" are wrongly depending on "this" #39

Closed weizman closed 1 year ago

weizman commented 1 year ago

If you look at listeners.js#L30 and listeners.js#L41 you'd see that in both addEventListener and removeEventListener listeners patches the call for the native functions rely on this being the this value of the call.

So if you call {window/document/document.body}.{addEventListener/removeEventListener}('some_event', () => {}) it'll work, but if you do {addEventListener/removeEventListener}('some_event', () => {}) the this will resolve to undefined even though it should be window.

This needs to be fixed.

weizman commented 1 year ago

fixed #40