-
Notifications
You must be signed in to change notification settings - Fork 0
/
closed.html
64 lines (52 loc) · 1.45 KB
/
closed.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
<!DOCTYPE html>
<title> Closed ShadowRoot </title>
<style> strong { color: green; } </style>
<script type="module">
class ShadowScriptElement extends HTMLElement {
#shadowRoot = null;
constructor() {
super();
this.#shadowRoot = this.attachShadow({ mode:'closed' });
this.#shadowRoot.innerHTML = this.template;
}
get template() {
return `
<style>.passed{color:green}</style>
<div id="test"> TEST A </div>
<slot></slot>
<script>
let a = this.querySelector('#test');
let b = this.host?.firstElementChild;
a && a.classList.add('passed');
b && (b.style.color = 'green');
<\/script>
`;
}
get #scripts() {
return this.#shadowRoot.querySelectorAll('script');
}
#scopedEval = (script) =>
Function(script).bind(this.#shadowRoot)();
#processScripts() {
this.#scripts.forEach(
s => this.#scopedEval(s.innerHTML)
);
}
connectedCallback() {
this.#processScripts();
}
}
customElements.define('shadow-script', ShadowScriptElement);
</script>
<shadow-script>
<p> TEST B </p>
</shadow-script>
<script>
let ss = document.querySelector('shadow-script');
try {
ss.shadowRoot.innerHTML += `<script>alert('BREACHED!');`;
ss.remove(); document.body.append(ss)
} catch (e) {
document.body.innerHTML += '<strong> NOT BREACHED!';
}
</script>