Custom project thumbnail website

Advanced Topics Mods & Extensions
, , ,
21

only if website allows to do that in onmessage

snap lets websites postMessage javascript code to execute:

  • api.js:

    window.onmessage = function (event) {
    // make the API accessible from outside an iframe
    var ide = world.children[0];
    if (!isNil(event.data.selector)) {
        window.top.postMessage(
            {
                selector: event.data.selector,
                response: ide[event.data.selector].apply(ide, event.data.params)
            },
            '*'
        );
    }
};

  • morphic.js:

    Morph.prototype.evaluateString = function (code) {
    var result;

    try {
        result = eval(code);
        this.changed();
    } catch (err) {
        this.inform(err);
    }
    return result;
};
22

ok, but any website can run code through api.js to run malicious code.

23

yes, if website has access to snap's window object