blob: 3a71a3d836cdfe5a5ad5b496fc8ab676f362b4d7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
<!DOCTYPE html>
<html>
<script>
document.expando = 42;
document.shadowedIframe = 42;
Object.setPrototypeOf(document, Object.create(HTMLDocument.prototype,
{
shadowedIframe: { value: 42 },
iframe: { value: 42 },
defaultView: { value: 42 },
addEventListener: { value: 42 },
toString: { value: 42 },
}));
document.documentElement.expando = 42;
Object.defineProperty(document.documentElement, "version", { value: 42 });
</script>
<iframe name="shadowedIframe" id="shadowedIframe"></iframe>
<iframe name="iframe" id="iframe"></iframe>
<iframe name="document" id="document"></iframe>
<iframe name="self" id="self"></iframe>
<iframe name="addEventListener" id="addEventListener"></iframe>
<iframe name="toString" id="toString"></iframe>
<iframe name="item" id="item"></iframe>
</html>
|
