RegExp for modifyObstructiveCode replaces var names started with top with self when it shouldn't

[indooorsman]

cypress/packages/server/lib/util/security.js

Line 17 in b568e82

const topOrParentEqualityBeforeRe = /((?:window|self)(?:\.|\[['"](?:top|self)['"]\])?\s*[!=]==?\s*(?:(?:window|self)(?:\.|\[['"]))?)(top|parent)/g

One of my file contains the below code:

if (topTarget.window === topTarget) { ... }

in Cypress, It's replaced with

if (topTarget.window === selfTarget) { ... }

and it caused error.

Please fix it as soon as possible, many thanks <3

[jennifer-shehane]

Hey @indooorsman, this is intended behavior in Cypress in order to have sites tested in Cypress work correctly - as they are run from within an iframe - and some sites have framebusting code.

You can turn off this behavior by setting modifyObstructiveCode: false in your configuration.

I'd like to more fully understand the error you are getting and the unintended effect that Cypress seems to have caused in your application though. Can you post the error and explain the unexpected behavior more fully? Thanks.

[indooorsman]

@jennifer-shehane Thanks for your reply, the error is selfTarget is not defined.
The original code:

funcA(topTarget) {
  if (topTarget.window === topTarget) { ... }
}

In cypress it's replaced with:

funcA(topTarget) {
  if (topTarget.window === selfTarget) { ... }
}

Of course, selfTarget is not defined.

And I think the regexp topOrParentEqualityBeforeRe has bugs.

About setting modifyObstructiveCode in configuration, it's better to have a default value of false in my opinion.

[jennifer-shehane]

@indooorsman Thanks. Yeah, indeed - I agree this RegExp is too lenient in this situation and is definitely a problem. Thanks for clearing this up - we need to fix this.

[cypress-bot]

The code for this is done in cypress-io/cypress#4831, but has yet to be released.
We'll update this issue and reference the changelog when it's released.

[indooorsman]

@jennifer-shehane Great, thanks for your efficient actions 💯

[jennifer-shehane]

Released in 3.4.1