From f068df16180fa2114d9e1ed9c4b66da0426ce969 Mon Sep 17 00:00:00 2001 From: Libor Polčák Date: Aug 25 2021 15:20:23 +0000 Subject: test page: Add iframes --- diff --git a/docs/test/iframe.html b/docs/test/iframe.html new file mode 100644 index 0000000..6da8ec9 --- /dev/null +++ b/docs/test/iframe.html @@ -0,0 +1,10 @@ + + + Iframe content + + + + + + + diff --git a/docs/test/iframe.js b/docs/test/iframe.js new file mode 100644 index 0000000..255d508 --- /dev/null +++ b/docs/test/iframe.js @@ -0,0 +1,21 @@ +"use strict"; + +function createResults(canvas_el, result_id) { + var html = "

toDataURL

"; + html += "
" + canvas_el.toDataURL + "
"; + html += "

getImageData

"; + html += "
" + canvas_el.getContext('2d').getImageData + "
"; + html += "

toBlob

"; + html += "
" + canvas_el.toBlob + "
"; + + var iframe = document.createElement("iframe"); + document.body.appendChild(iframe); + // Native toString function from iframe context which can be used later on. + var iframeToString = iframe.contentWindow.window.Function.prototype.toString; + iframe.parentNode.removeChild(iframe); + html += "

performance.now

"; + html += "
" + iframeToString.call(performance.now) + "
"; + + document.getElementById(result_id).innerHTML = html; +} +createResults(document.createElement("canvas"), "iframe_result"); diff --git a/docs/test/poc.js b/docs/test/poc.js new file mode 100644 index 0000000..680548d --- /dev/null +++ b/docs/test/poc.js @@ -0,0 +1,4 @@ +"use strict"; + +createResults(document.getElementById("poc_iframe").contentDocument.createElement("canvas"), "poc"); +createResults(document.getElementById("regular_iframe").contentDocument.createElement("canvas"), "regular"); diff --git a/docs/test/test.html b/docs/test/test.html index 1337b37..aa64a7b 100644 --- a/docs/test/test.html +++ b/docs/test/test.html @@ -22,6 +22,8 @@ SPDX-License-Identifier: GPL-3.0-or-later + + @@ -209,5 +211,26 @@ SPDX-License-Identifier: GPL-3.0-or-later

window.XMLHttpRequest example

+


+ +

Wrappers and iframes

+

Iframes can be misused to evade wrappers. Prior to 0.5, jShelter limited some wrappers but not + all. To be fully protected, you should see [native code] as a body + of all displayed functions. Note that you should see the same content even if you do not use any + extension that modifies the calls. We want not to be distinguishable even if fully protected to + limit fingerprinting.

+

JavaScript executed in the main page

+ + + +

JavaScript executed in a regular iframe

+ + + +

JavaScript executed in a same origin iframe

+ +