Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update "Namespace Isolation" pattern description #11

Merged
merged 2 commits into from
Nov 7, 2024

Conversation

ericcornelissen
Copy link
Contributor

Relates to #10

@ericcornelissen
Copy link
Contributor Author

Also, some newer <iframe>-based clobbering techniques might be able to sidestep it.

Am I correct in understanding this applies to both the MutationObserver-based approach as well as DOMPurify? I haven't currently written it this way in the PR because I haven't tried the DOMPurify solution.

@SoheilKhodayari
Copy link
Owner

Am I correct in understanding this applies to both the MutationObserver-based approach as well as DOMPurify? I haven't currently written it this way in the PR because I haven't tried the DOMPurify solution.

I think It only affects the MutationObserver-based approach, because the parent page cannot monitor the DOM of the framed pages. DOMPurify can see and remove the id and name attributes of such clobbering markups before they are injected to the DOM.

@SoheilKhodayari SoheilKhodayari added documentation Improvements or additions to documentation enhancement New feature or request labels Nov 7, 2024
@SoheilKhodayari SoheilKhodayari merged commit a754155 into SoheilKhodayari:master Nov 7, 2024
1 check failed
@ericcornelissen ericcornelissen deleted the patch-1 branch November 7, 2024 09:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants