babel: transform-es2015-typeof-symbol causes cross-domain error in IE

transform-es2015-typeof-symbol converts typeof foo to _typeof(foo) when typeof Symbol.iterator !== "symbol". _typeof is implemented as follows:

function(obj) {
        return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj;
}

That obj.constructor property lookup throws an error when it’s applied to a cross-domain window object. For example, typeof window.frames[0] transpiles to _typeof(window.frames[0]) which ends up calling window.frames[0].constructor, which triggers a cross-domain permission error.

Input Code

typeof window.frames[0];
"use strict";

var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };

_typeof(window.frames[0]);

Babel Configuration (.babelrc, package.json, cli command)

{
    "presets": [ "es2015" ]
}

Expected Behavior

_typeof should not try to access privileged properties on a cross-domain window object.

Current Behavior

_typeof tries to access privileged properties on a cross-domain window object.

Possible Solution

try/catch and fall-back to typeof?

Context

Broke the following addition to post-robot, which allows sending messages to remote windows. We validate the passed window using typeof to ensure it’s at least an "object"

Your Environment

software version
Babel 6
node 4
npm 3
Operating System Windows 7 / IE9-11

About this issue

  • Original URL
  • State: open
  • Created 7 years ago
  • Comments: 15 (6 by maintainers)

Most upvoted comments

typeof window.frames[0].location.href

VM92:1 Uncaught DOMException: Blocked a frame with origin "http://www.bluesuncorp.co.uk" from accessing a cross-origin frame.
    at <anonymous>:1:33