Ultraviolet icon indicating copy to clipboard operation
Ultraviolet copied to clipboard

hCaptcha will not load when UV is iframed (about:blank)

Open itschasa opened this issue 10 months ago • 6 comments

without about:blank cloak: image

with about:blank cloak (iframe): image

iframe to front end:

<iframe src="https://******" style="height:100%; width: 100%; border: none; position: fixed; top: 0; right: 0; left: 0; bottom: 0; border: none" sandbox="allow-forms allow-downloads allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-same-origin allow-scripts allow-top-navigation allow-top-navigation-by-user-activation"></iframe>

iframe for service worker to pickup:

<iframe sandbox="allow-same-origin allow-downloads allow-scripts allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-presentation" srv="us1" src="https://******/'service'/*****"></iframe>

this probably isn't fixable, as no errors are appearing in console. most likely hcaptcha blocking when 2 iframes deep (3 iframes deep from its perspective (about:blank > uv > hcaptcha iframe))? not sure, but best to report it incase others have issues

recaptcha still works fine when about:blank-ed

itschasa avatar Apr 11 '24 20:04 itschasa

yeah this is a known issue, not sure how we would go about fixing it

probably going to keep this issue open though for further discussion

Percslol avatar Apr 14 '24 06:04 Percslol

Which version are you using? image you can try https://hideip.network/

allmors avatar Apr 22 '24 08:04 allmors

Which version are you using?

image

you can try https://hideip.network/

Did you try it whilst about:blank cloaking was enabled?

itschasa avatar Apr 22 '24 09:04 itschasa

Which version are you using? image you can try https://hideip.network/

Did you try it whilst about:blank cloaking was enabled?

After testing, uv cannot rewrite iframe again

allmors avatar Apr 23 '24 02:04 allmors

After testing, uv cannot rewrite iframe again

image

looks like UV can inject itself into an iframe whilst about:blank cloaked, but hcaptcha just refuses to load, most likely a security mesaure by hcaptcha, preventing captchas being done whilst 2 iframes deep already

itschasa avatar Apr 25 '24 15:04 itschasa

probably need to check if hcaptcha uses postMessage, and if it requires a trusted Message event, or correct origin?

itschasa avatar Apr 29 '24 07:04 itschasa