Recovering built-in methods that have been overwritten

var iframe = document.createElement("iframe");
document.documentElement.appendChild(iframe);
var _window = iframe.contentWindow;
String.prototype.split = _window.String.prototype.split;
document.documentElement.removeChild(iframe);

Use iframes to recover methods from host objects.

Note there are traps with this method.

"foo".split("") instanceof Array // false
"foo".split("") instanceof _window.Array // true

The best way to fix this is to not use instanceof, ever.

Also note that var _split = String.prototype.split as a <script> tag before the naughty script or not including the naughty script is obvouisly a far better solution.

Leave a Comment