[vulnerability] Scripts containing __hook__ can skip hooking via textContent property

[t2ym]

[vulnerability] Scripts containing __hook__ can skip hooking via textContent property

Root Cause

• Recognition failure of scripts without hooking when they contain __hook__ strings even in string literals if script.type is set as non-JavaScript MIME types and then reconfigured as one of the JavaScript MIME types or empty.

Possible Fix

• Script contents are always recognized as JavaScript regardless of their configured MIME types.

Reproducible Code Examples

    {
      // Fake hooked script vulnerability #1 - setAttribute('type')
      addEventListener('load', function () {
        let script = document.createElement('script');
        script.setAttribute('type', 'text/plain');
        script.textContent = `
          chai.assert.throws(() => {
            // __hook__
            {
              let c = caches;
              console.log(c);
            }
          }, /^Permission Denied:/);`;
        script.setAttribute('type', 'text/javascript');
        document.head.appendChild(script);
      });
    }
    {
      // Fake hooked script vulnerability #2 - .type property
      addEventListener('load', function () {
        let script = document.createElement('script');
        script.type = 'text/plain';
        script.textContent = `
          chai.assert.throws(() => {
            // __hook__
            {
              let c = caches;
              console.log(c);
            }
          }, /^Permission Denied:/);`;
        script.type = 'text/javascript';
        document.head.appendChild(script);
      });
    }