poc

LavaMoat · Oct 26, 2024 · fafe7a9 · fafe7a9
1 parent 6e6e212
commit fafe7a9
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 10 deletions.
diff --git a/packages/core/src/element.mjs b/packages/core/src/element.mjs
@@ -1,14 +1,17 @@
 'use strict';
 
 import {
+    appendChild,
     Array,
     createElement,
     entries, from,
     join, keys, map,
     parseInt, random,
     setAttribute,
     textContentSet,
-    toFixed,
+    toFixed, define,
+    HTMLElement,
+    customElements,
 } from './native.mjs';
 import {chars} from './char.mjs';
 
@@ -55,6 +58,14 @@ export const distraction = invoker(creator({
     'font-size': '1px',
 }, () => 'span', all));
 
-export const loadable = invoker(creator({
-    'display': 'none',
-}, () => 'iframe'));
+//
+export const loadable = function(cb) {
+    class Loadable extends HTMLElement {
+        constructor() { super() }
+        connectedCallback() { cb(element) }
+    }
+    const tag = rand(10) + '-' + rand(10);
+    define(customElements, tag, Loadable);
+    const element = createElement(document, tag);
+    return parent => appendChild(parent, element);
+}
diff --git a/packages/core/src/lavadome.mjs b/packages/core/src/lavadome.mjs
@@ -9,7 +9,6 @@ import {
     appendChild,
     replaceChildren,
     textContentSet,
-    addEventListener,
     ownerDocument,
     navigation,
     url, destination, includes,
@@ -40,9 +39,8 @@ export function LavaDome(host, opts) {
     replaceChildren(shadow);
 
     // fire every time instance is reloaded and abort loading for non-top documents
-    const iframe = loadable();
-    addEventListener(iframe, 'load', () => {
-        const ownerDoc = ownerDocument(iframe);
+    const attach = loadable(element => {
+        const ownerDoc = ownerDocument(element);
         if (ownerDoc !== document) {
             replaceChildren(shadow);
             throw new Error(`LavaDomeCore: ` +
@@ -69,7 +67,7 @@ export function LavaDome(host, opts) {
         }
 
         // attach loadable only once per instance to avoid excessive load firing
-        appendChild(shadow, iframe);
+        attach(shadow);
 
         // place each char of the secret in its own LavaDome protection instance
         map(from(text), char => {

diff --git a/packages/core/src/native.mjs b/packages/core/src/native.mjs
@@ -6,6 +6,8 @@ const {
     parseInt, WeakMap,
     Error, JSON,
     navigation,
+    HTMLElement,
+    customElements,
 } = globalThis;
 const {
     defineProperties, assign,
@@ -21,7 +23,6 @@ const n = (obj, prop, accessor) =>
     obj && Function.prototype.call.bind(getOwnPropertyDescriptor(obj, prop)[accessor]);
 
 export const ownerDocument = n(globalThis?.Node?.prototype, 'ownerDocument', 'get');
-export const addEventListener = n(globalThis?.EventTarget?.prototype, 'addEventListener', 'value');
 export const replaceChildren = n(globalThis?.DocumentFragment?.prototype, 'replaceChildren', 'value');
 export const attachShadow = n(globalThis?.Element?.prototype, 'attachShadow', 'value');
 export const createElement = n(globalThis?.Document?.prototype, 'createElement', 'value');
@@ -41,6 +42,7 @@ export const destination = n(globalThis?.NavigateEvent?.prototype, 'destination'
 export const url = n(globalThis?.NavigationDestination?.prototype, 'url', 'get');
 export const preventDefault = n(globalThis?.Event?.prototype, 'preventDefault', 'value');
 export const stopPropagation = n(globalThis?.Event?.prototype, 'stopPropagation', 'value');
+export const define = n(globalThis?.CustomElementRegistry?.prototype, 'define', 'value');
 
 export {
     // window
@@ -49,6 +51,8 @@ export {
     parseInt, WeakMap,
     Error, JSON,
     navigation,
+    HTMLElement,
+    customElements,
     // Object
     defineProperties, assign,
     getOwnPropertyDescriptor,