Fix cross-origin-frame-redact watcher missing top-level iframes

twschiller · claude · twschiller · commit ec081a3de08a · 2026-06-04T21:05:02.000-04:00
The watcher's onSubtrees handed each added subtree root to scan(), which
calls querySelectorAll('iframe') on it. querySelectorAll matches
descendants only, so a bare cross-origin &lt;iframe&gt; appended directly to
document.body slipped past the watcher (the iframe itself is the root,
and it has no iframe descendants).

Mirror the workaround already documented in selector-hide-rule.ts: drop
the per-root loop and rescan from document.body on every batch. The
is-connected / is-revealed checks in scan() keep it idempotent, and the
watcher's throttle coalesces bursts.

Add a regression test that appends a bare iframe directly to body.

Co-Authored-By: Claude Opus 4.7 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/extension/src/rules/__tests__/cross-origin-frame-redact.test.ts b/extension/src/rules/__tests__/cross-origin-frame-redact.test.ts
@@ -189,6 +189,24 @@ describe("crossOriginFrameRedactRule", () => {
       expect(getPlaceholder()).not.toBeNull();
     });
 
+    // Regression: when an iframe is appended directly (no wrapper), the
+    // MutationObserver root *is* the iframe, and querySelectorAll on it
+    // returns nothing. The watcher must rescan from document.body to catch
+    // this case.
+    it("replaces a bare cross-origin iframe appended directly to body", async () => {
+      crossOriginFrameRedactRule.apply(document.body);
+
+      const iframe = document.createElement("iframe");
+      iframe.src = "https://example.com/widget";
+      document.body.append(iframe);
+
+      await flushMutations();
+      jest.advanceTimersByTime(MUTATION_THROTTLE_MS);
+
+      expect(document.querySelector("iframe")).toBeNull();
+      expect(getPlaceholder()).not.toBeNull();
+    });
+
     it("teardown stops the observer so later additions are ignored", async () => {
       crossOriginFrameRedactRule.apply(document.body);
       crossOriginFrameRedactRule.teardown();
diff --git a/extension/src/rules/cross-origin-frame-redact.ts b/extension/src/rules/cross-origin-frame-redact.ts
@@ -77,10 +77,13 @@ function scan(root: ParentNode): void {
 }
 
 const watcher = createSubtreeWatcher({
-  onSubtrees: (roots) => {
-    for (const root of roots) {
-      scan(root);
-    }
+  // MutationObserver hands us the newly-inserted element itself, but
+  // querySelectorAll on that element does not match the element itself —
+  // so a bare cross-origin <iframe> appended directly to document.body
+  // would be missed. Rescan from document.body on every batch; the
+  // is-connected / is-revealed checks in scan() keep it idempotent.
+  onSubtrees: () => {
+    scan(document.body);
   },
   skipPlaceholderSubtrees: true,
 });
