Refuse to migrate from top into non-top documents

packages/core/src/element.mjs

@@ -51,4 +51,8 @@ export const distraction = invoker(creator({
     'top': '-10px', 'right': '-10px', 'position': 'fixed',
     // font-size smaller than 1px fails to be a distraction on Firefox
     'font-size': '1px',
-}, () => 'span', all));
+}, () => 'span', all));
+
+export const loadable = invoker(creator({
+    'display': 'none',
+}, () => 'iframe'));

packages/core/src/lavadome.mjs

@@ -9,10 +9,26 @@ import {
     appendChild,
     replaceChildren,
     textContentSet,
+    addEventListener,
+    ownerDocument,
+    navigation,
+    url, destination, includes,
+    preventDefault, stopPropagation,
 } from './native.mjs';
-import {distraction, unselectable} from './element.mjs';
+import {distraction, loadable, unselectable} from './element.mjs';
 import {getShadow} from './shadow.mjs';
 
+// text-fragments links can be abused to leak shadow internals - block in-app redirection to them
+navigation.addEventListener('navigate', event => {
+    const dest = url(destination(event));
+    if (includes(dest, ':~:')) {
+        preventDefault(event);
+        stopPropagation(event);
+        throw new Error(
+            `LavaDomeCore: in-app redirection to text-fragments links is blocked to ensure security`);
+    }
+});
+
 export function LavaDome(host, opts) {
     opts = options(opts);
 
@@ -23,6 +39,18 @@ export function LavaDome(host, opts) {
     const shadow = getShadow(host, opts);
     replaceChildren(shadow);
 
+    // fire everytime instance is reloaded and bail if occurs under non-top documents
+    const ifr = loadable();
+    addEventListener(ifr, 'load', () => {
+        const ownerDoc = ownerDocument(ifr);
+        if (ownerDoc !== document) {
+            replaceChildren(shadow);
+            throw new Error(`LavaDomeCore: ` +
+                `The document to which LavaDome was originally introduced ` +
+                `must be the same as the one this instance is inserted to`);
+        }
+    });
+
     // child of the shadow, where the secret is set, must be unselectable
     const child = unselectable();
     appendChild(shadow, child);
@@ -40,6 +68,9 @@ export function LavaDome(host, opts) {
             return textContentSet(child, text);
         }
 
+        // attach loadable only once per instance to avoid excessive load firing
+        appendChild(shadow, ifr);
+
         // place each char of the secret in its own LavaDome protection instance
         map(from(text), char => {
             const span = createElement(document, 'span');

packages/core/src/native.mjs

@@ -5,6 +5,7 @@ const {
     Function, Math,
     parseInt, WeakMap,
     Error, JSON,
+    navigation,
 } = globalThis;
 const {
     defineProperties, assign,
@@ -19,27 +20,35 @@ const { stringify } = JSON;
 const n = (obj, prop, accessor) =>
     obj && Function.prototype.call.bind(getOwnPropertyDescriptor(obj, prop)[accessor]);
 
+export const ownerDocument = n(globalThis?.Node?.prototype, 'ownerDocument', 'get');
+export const addEventListener = n(globalThis?.EventTarget?.prototype, 'addEventListener', 'value');
 export const replaceChildren = n(globalThis?.DocumentFragment?.prototype, 'replaceChildren', 'value');
 export const attachShadow = n(globalThis?.Element?.prototype, 'attachShadow', 'value');
 export const createElement = n(globalThis?.Document?.prototype, 'createElement', 'value');
 export const appendChild = n(globalThis?.Node?.prototype, 'appendChild', 'value');
 export const textContentSet = n(globalThis?.Node?.prototype, 'textContent', 'set');
 export const setAttribute = n(globalThis?.Element?.prototype, 'setAttribute', 'value');
 export const toUpperCase = n(globalThis?.String?.prototype, 'toUpperCase', 'value');
+export const includes = n(globalThis?.String?.prototype, 'includes', 'value');
 export const map = n(globalThis?.Array?.prototype, 'map', 'value');
 export const join = n(globalThis?.Array?.prototype, 'join', 'value');
 export const keys = n(globalThis?.Array?.prototype, 'keys', 'value');
 export const at = n(globalThis?.Array?.prototype, 'at', 'value');
 export const get = n(globalThis?.WeakMap?.prototype, 'get', 'value');
 export const set = n(globalThis?.WeakMap?.prototype, 'set', 'value');
-export const toFixed = n(globalThis?.Number?.prototype, 'toFixed', 'value')
+export const toFixed = n(globalThis?.Number?.prototype, 'toFixed', 'value');
+export const destination = n(globalThis?.NavigateEvent?.prototype, 'destination', 'get');
+export const url = n(globalThis?.NavigationDestination?.prototype, 'url', 'get');
+export const preventDefault = n(globalThis?.Event?.prototype, 'preventDefault', 'value');
+export const stopPropagation = n(globalThis?.Event?.prototype, 'stopPropagation', 'value');
 
 export {
     // window
     Object, Array,
     Function, Math,
     parseInt, WeakMap,
     Error, JSON,
+    navigation,
     // Object
     defineProperties, assign,
     getOwnPropertyDescriptor,