iframe.contentWindow evasion can leak Object.apply in stack traces

[prescience-data]

Similar to #209 there is instances in the wild searching for: Object.apply (<anonymous> in thrown error stack traces.

Real browser:

Error: Failed to execute 'createElement' on 'Document': The tag name provided ([redacted]) is not a valid name.
    at test.js?660921:2

Puppeteer with Extra Stealth 2.6.1

Error: Failed to execute 'createElement' on 'Document': The tag name provided ([redacted]) is not a valid name.
    at Object.apply (<anonymous>:80:31)
    at test.js?103622:2

Second case fails the vendor detection test.

[momala454]

careful to not remove all Object.apply, which could be detected by purposely creating a stack containing Object.apply

[Niek]

Sample test code:

try {
    document["createElement"](0);
} catch (e) {
    console.log(e.stack)
}

[prescience-data]

Sample test code:

try {
    document["createElement"](0);
} catch (e) {
    console.log(e.stack)
}

Sample code including the observed detection:

var detection;
var stack;
try {
    document.createElement(0);
} catch (err) {
    try {
        stack = err.stack.split('\n');
        detection = (stack.length >= 2) ? !!stack[1].match(/Ob[cej]{3}t\.a[lp]{3}y[\(< ]{3}an[oynm]{5}us>/) : 'Normal stack trace.';
    } catch (errOfErr) {
        detection = 'Stack trace hijacked.';
    }
}

[berstend]

This is leveraging the ancient/shitty iframe.contentWindow evasion, which hasn't been updated yet to use the new stealth utilities:

puppeteer-extra/packages/puppeteer-extra-plugin-stealth/evasions/iframe.contentWindow/index.js

Line 95 in 12fe3af

const createElement = {

[berstend]

Workaround for the time being: Disabling the iframe.contentWindow evasion

[berstend]

Fixed in puppeteer-extra-plugin-stealth@2.6.5