24 lines
826 B
HTML
24 lines
826 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<script>
|
|
document.expando = 42;
|
|
document.shadowedIframe = 42;
|
|
Object.setPrototypeOf(document, Object.create(HTMLDocument.prototype,
|
|
{
|
|
shadowedIframe: { value: 42 },
|
|
iframe: { value: 42 },
|
|
defaultView: { value: 42 },
|
|
addEventListener: { value: 42 },
|
|
toString: { value: 42 },
|
|
}));
|
|
document.documentElement.expando = 42;
|
|
Object.defineProperty(document.documentElement, "version", { value: 42 });
|
|
</script>
|
|
<div name="shadowedIframe" id="shadowedIframe"></div>
|
|
<div name="iframe" id="iframe"></div>
|
|
<div name="document" id="document"></div>
|
|
<div name="self" id="self"></div>
|
|
<div name="addEventListener" id="addEventListener"></div>
|
|
<div name="toString" id="toString"></div>
|
|
<div name="item" id="item"></div>
|
|
</html>
|