From 9df2046bd8a86b565cddb6e2561cb96cd4086869 Mon Sep 17 00:00:00 2001 From: niutech <384997+niutech@users.noreply.github.com> Date: Wed, 11 Feb 2026 21:29:46 +0000 Subject: [PATCH] Improve security and robustness of x-frame-bypass - Removed 'allow-same-origin' from default sandbox to prevent XSS and cross-origin leakage. - Switched to 'postMessage' for communication between iframe and parent for better compatibility and security. - Improved link and form interception using 'closest' and better target detection. - Added support for loading pages without a tag. - Added support for local URLs (localhost/127.0.0.1) without using a proxy. - Added 'proxies' attribute to allow custom proxy configuration. --- x-frame-bypass.js | 89 ++++++++++++++++++++++++----------------------- 1 file changed, 46 insertions(+), 43 deletions(-) diff --git a/x-frame-bypass.js b/x-frame-bypass.js index c6e2e37..0d50d74 100644 --- a/x-frame-bypass.js +++ b/x-frame-bypass.js @@ -9,70 +9,73 @@ customElements.define('x-frame-bypass', class extends HTMLIFrameElement { this.load(this.src) } connectedCallback () { - this.sandbox = '' + this.sandbox || 'allow-forms allow-modals allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-same-origin allow-scripts allow-top-navigation-by-user-activation' // all except allow-top-navigation + if (!this.getAttribute('sandbox')) this.sandbox = 'allow-forms allow-modals allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-top-navigation-by-user-activation' + this._onMessage = e => { + if (e.source === this.contentWindow && e.data && e.data.type === 'X-Frame-Bypass-Load') { + this.load(e.data.url, e.data.options) + } + } + window.addEventListener('message', this._onMessage) + } + disconnectedCallback () { + window.removeEventListener('message', this._onMessage) } load (url, options) { if (!url) return - if (!url.startsWith('http')) throw new Error(`X-Frame-Bypass src ${url} does not start with http(s)://`) + if (!url.startsWith('http')) throw new Error('X-Frame-Bypass src ' + url + ' does not start with http(s)://') console.log('X-Frame-Bypass loading:', url) - this.srcdoc = ` - - -
' + if (options && options.body && !(options.body instanceof FormData)) { + const formData = new FormData() + Object.entries(options.body).forEach(([key, value]) => formData.append(key, value)) + options.body = formData } - } - - - -
- -` this.fetchProxy(url, options, 0).then(res => res.text()).then(data => { - if (data) this.srcdoc = data.replace(/]*)>/i, ` - - `).replace(/ crossorigin=['"][^'"]*['"]/gi, '') +` + let html = data.replace(/]*)>/i, '' + script) + if (html === data) { + html = '' + script + data + } + this.srcdoc = html.replace(/ crossorigin=['"][^'"]*['"]/gi, '') }).catch(e => console.error('Cannot load X-Frame-Bypass:', e)) } fetchProxy (url, options, i) { - const proxies = (options || {}).proxies || [ + const proxies = (options || {}).proxies || (this.getAttribute('proxies') ? this.getAttribute('proxies').split(',') : [ 'https://api.allorigins.win/raw?url=', 'https://api.codetabs.com/v1/proxy/?quest=', 'https://cors-anywhere.herokuapp.com/' - ] + ]) + if (url.startsWith('http://localhost') || url.startsWith('http://127.0.0.1')) { + return fetch(url, options).then(res => { + if (!res.ok) throw new Error(res.status + ' ' + res.statusText); + return res + }) + } return fetch(proxies[i] + encodeURIComponent(url), options).then(res => { - if (!res.ok) throw new Error(`${res.status} ${res.statusText}`); + if (!res.ok) throw new Error(res.status + ' ' + res.statusText); return res }).catch(error => { if (i === proxies.length - 1) throw error