search

hackademix / noscript

The popular NoScript Security Suite browser extension.
https://noscript.net/
GNU General Public License v3.0
844 stars 90 forks source link

patchWindow.js might try to patch non-window objects and log errors #343

Open Karuljonnai opened 7 months ago

Karuljonnai commented 7 months ago

On my SO post, I enter in detail on how I got a bug because of NoScript. But, basically, on patchWindow.js:291, it's using a deprecated interface HTMLFrameElement, which throws an TypeError: win[(("HTML" + (intermediate value)) + "Element")] is undefined

hackademix commented 7 months ago

On my SO post

That link seems broken.

Which browser version are you finding this in?

However probably checking if the interface is there is a good idea anyway.

Karuljonnai commented 7 months ago

I updated the link. I'm on Kubuntu 22.04, Firefox 123.0, NoScript 11.4.29

hackademix commented 7 months ago

Is the i variable numeric (i.e. "0")?

Karuljonnai commented 7 months ago

Yes, .map enumerates the results with the 2nd argument i.

hackademix commented 7 months ago

Yes, .map enumerates the results with the 2nd argument i.

Then what is happening is quite clear: you're adding your elements as window[number], which would normally reference subframes' window objects (where HTMLFrameElement is defined - deprecation is not the issue here).

Fortunately this cannot alias the actual window objects (meant to be wrapped) if they're present, and your code won't break anyway because the exception is just logged, not rethrown, but that's annoying nonetheless, if nothing else because of the console noise.

Therefore I'm fixing this in next NoScript version, thanks.