Run the following snippet twice (either in the post proper, or in the snippet editor). On subsequent runs, rather than the form posting to the embedded result iframe, a new window is opened:
console.log('Original window name:', window.name);
window.name = 'foo';
/*
Acquire an unsandboxed, top-level tab/window on the browsers of other SO users:
if (window.parent === window) {
window.location.href = 'https://disguised-phishing-or-malware-or-advertisement';
}
*/
The browser uses the target
of a submitted form to determine where the response is displayed: it tries to find an iframe with a matching name
, eg:
<form target="iframename">
<textarea name="foo">valueToProcess</textarea>
</form>
<iframe name="iframename"></iframe>
But when the iframe sets its window.name
internally, subsequent submissions from the parent window no longer recognize the iframe as a valid target, so a new window opens instead.
Accidentally reassigning window.name
is a relatively common problem. The content of a Stack Snippet should not have an effect outside of the iframe. I'm a bit doubtful if there's a method to get the existing cross-origin iframe to be recognized again from Javascript inside the parent window - maybe there is, but I didn't find one after playing around a bit. In addition, messing with the child window (so as to prevent window.name
reassignment) is a bit undesirable. But, a theoretically simple workaround would be to create another iframe (a new _boxResult
) on each submission, discarding the possibly-broken old one.
Just as a proof-of-concept, before pressing "Run code snippet" again, if you open your browser console and paste in the following code:
document.querySelector('iframe').outerHTML += '';
you'll see that the response remains in the iframe as it should be.
An answer that's currently deleted (thanks Toronto Raptors) shows that you can also change the original page via window.opener
, which may have even more potential for abuse:
window.name = 'something else';
if (window.parent !== window) {
console.error("Run me again!");
} else {
// Load my evil fake Stack Exchange login screen
window.opener.location = 'https://liveweb.archive.org/https://stackoverflow.com/users/login';
setTimeout(() => {
console.log('Working...');
}, 3000);
// Give the replaced page time to load
setTimeout(() => {
console.log('Go back and try to answer my question');
// When the user closes the new opened window themselves,
// they have no reason to suspect that the old SO window is now untrustworthy
}, 6000);
}
_boxResult
s here, every time the snippet is run again. Inside thefunction SnippetEditor
, the persistent_boxResult
is only used for a UUID to read and post to - maybe have just the UUID be persistent instead, then right before the two calls ofform.submit();
, replace the#snpte-box-edit-result
iframe.function Snippet
) really does need the current iframe to be persistent forhide
to work. Maybe change theif (!_boxResult) { _boxResult = makeIFrame(); _results.append(_boxResult); }
to an unconditional replacement and reassignment of the previous_boxResult