JSFiddle - React, Tailwind, and code Playground

by rich_harris

JavaScript

// The attacker wants to capture any object properties
// called 'sekrit' (since property names aren't mangled,
// they were able to see it in the app's minified code)
function sendToEvilServer ( value ) {
    alert( 'sending ' + value + ' to evil server' );
}

Object.defineProperty(Object.prototype, 'sekrit', {
    get: function () {
        return _value;
    },
    set: function ( value ) {
        _value = value;
        sendToEvilServer( value );
    }
});


// The app developer thinks they're safe because the
// private stuff is hidden from the global namespace
(function () {
    var user = {};
    user.sekrit = 'veryImportantPassword';
})();