From 77d1378e86d08aec531c6d20d0d0ab8f2c04e7b1 Mon Sep 17 00:00:00 2001 From: weizman Date: Tue, 18 Jul 2023 16:38:54 +0300 Subject: [PATCH] Fix demo app after v2 breakage (#131) --- demo/index.html | 29 +++++++++++++++++++++++++++-- demo/util.js | 10 +++++----- 2 files changed, 32 insertions(+), 7 deletions(-) diff --git a/demo/index.html b/demo/index.html index a47e44f..814b12a 100644 --- a/demo/index.html +++ b/demo/index.html @@ -1,6 +1,31 @@ - + Snow @@ -32,7 +57,7 @@
- X X X + X X X

The Ultimate (Self) XSS Challenge 😈

~ Can you pop an alert in this page? diff --git a/demo/util.js b/demo/util.js index bbde272..321c711 100644 --- a/demo/util.js +++ b/demo/util.js @@ -3,14 +3,14 @@ function bypass(wins) { } function run(js) { - const script = document.createElement('script'); - script.textContent = '{' + js + '}'; - document.head.appendChild(script); + const b = new Blob([js], {type: 'text/javascript'}); + const u = URL.createObjectURL(b); + const s = document.createElement('script'); + s.src = u; + document.head.appendChild(s); } (function(){ - location.href.includes('self-xss-challenge-msg') && (msg.style.display = 'block'); - location.search.includes('disable') || SNOW((win) => { win.alert = (msg) => { console.log('Snow: ', 'alert API is disabled, message is printed to console instead: ', msg);