Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Recovering built-in methods that have been overwritten

Let's say that our script is included in a web-page, and a prior script (that already executed) did this:

String.prototype.split = function () {
    return 'U MAD BRO?';
};

So, the split string method has been overwritten.

We would like to use this method, so we need to recover it somehow. Of course, we could just define our own implementation of this method and use that instead. However, for the sake of this question, let's just say that we really wanted to recover the browser's implementation of that method.

So, the browser has an implementation of the split method (in native code, I believe), and this implementation is assigned to String.prototype.split whenever a new web-page is loaded.

We want that implementation! We want it back in String.prototype.split.

Now, I already came up with one solution - it's a hack, and it appears to be working, but it may have flaws, I would have to test a bit... So, in the meantime, can you come up with a solution to this problem?

like image 866
Šime Vidas Avatar asked Dec 20 '11 18:12

Šime Vidas


People also ask

Can data that has been overwritten be recovered?

If the file is overwritten, the new data overwrites the old one, such a file cannot be recovered. The new file may have the same name and size, but the content will be new.

Is overwritten data gone forever?

Once files have been overwritten once, they're only theoretically recoverable. When they've been overwritten more than once, they're gone forever. Deleted data on a solid-state drive – Solid-state drives work differently than HDDs, and when they delete data, they typically destroy it immediately.


1 Answers

var iframe = document.createElement("iframe");
document.documentElement.appendChild(iframe);
var _window = iframe.contentWindow;
String.prototype.split = _window.String.prototype.split;
document.documentElement.removeChild(iframe);

Use iframes to recover methods from host objects.

Note there are traps with this method.

"foo".split("") instanceof Array // false
"foo".split("") instanceof _window.Array // true

The best way to fix this is to not use instanceof, ever.

Also note that var _split = String.prototype.split as a <script> tag before the naughty script or not including the naughty script is obvouisly a far better solution.

like image 51
Raynos Avatar answered Oct 21 '22 05:10

Raynos