LavaMoat / snow

Use Snow to finally secure your web app's same origin realms!
https://lavamoat.github.io/snow/demo/
MIT License
102 stars 9 forks source link

Child frames are overlooked inside opened windows #84

Closed weizman closed 1 year ago

weizman commented 1 year ago

Fix attempt for #83

Cool bug.

Function findWin is being called on top to find the window we're looking for by recursively going down to all child realms of top. However, opened windows have their own top, so when they create a new child frame, findWin is called on the original top and not the opened window top, which naturally makes findWin to not find the window and therefore gives up on it and not applies protection to it.

Fixed by making findWin work on all tracked opened windows' tops instead of just the original top.