如何从新的 iframe 重置损坏的 JavaScript 数组对象？

Question

我有一个在网站上运行的脚本，我不能指望它的 window.Array 对象没有被覆盖。（它可能已被之前加载的另一个脚本更改）。

我创建了一个新的 iframe，我想将 window.Array 对象设置回原生数组原型

    // let's assume Array.prototype.filter function was changed by another script
    Array.prototype.filter = ()=>{return "haha!"}

    console.log('test overridden: ', new Array(1,2,3).filter(x=>x));
    console.log('test overridden literal:', [1,2,3].filter(x=>x));

    // prints test overridden: haha
    // prints test overridden literal: haha

    // get new window with native code from iframe
    var iframe = null;
    (iframe = document.createElement('iframe')).name = 'native_function';
    document.body.appendChild(iframe);
    var native = window.frames['native_function'];

    // here I am trying to set my broken Array to a new fresh copy
    Object.setPrototypeOf(Array, native.Array.prototype);

    console.log('test restored filter: ', new Array(1,2,3).filter(x=>x));
    console.log('test restored literal array filter', [1,2,3].filter(x=>x));

 
    // prints test restored filter: haha
    // prints test restored literal array filter: haha

    // It didn't work.

如何将我的 window.Array 恢复为本机。window.Array？

备注我想在iframewindow中将整个Array对象还原成原来的Array。不仅是我刚才用作示例的过滤功能。

Answer 1

I want to restore the entire Array object to the original Array in the iframe window

您无法覆盖从文字创建数组时使用的内置数组原型，因此您需要覆盖该原型上的方法。

const iframe = document.body.appendChild(document.createElement("iframe"));
const iframeArray = iframe.contentWindow.Array;
document.body.removeChild(iframe);

const nativeArrayProto = Object.getPrototypeOf([]);
for (const p of ["constructor", "filter", "map", "slice", /* … */])
    nativeArrayProto[p] = iframeArray.prototype[p];
Array = nativeArrayProto.constructor;
Array.prototype = nativeArrayProto;

如何从新的 iframe 重置损坏的 JavaScript 数组对象？

How to reset broken JavaScript Array Object from new iframe?

javascript

arrays

prototype-chain