Properties that leak the parent URL even when sandboxed

1

1

1

1

const regex = /^(?:https?):\/\/shazzer[.]co[.]uk/;0x0D
Object.getOwnPropertyNames(window).forEach(prop => {0x0D
   try{0x0D
      regex.test(window[prop]+'')&&log('window.'+prop)0x0D
   }catch{}0x0D
});0x0D
for(const prop in document){0x0D
  try{0x0D
       regex.test(document[prop]+'')&&log('document.'+prop);0x0D
  } catch{}0x0D
}

1337