Properties that contain leak the parent URL even when sandboxed

const regex = /(?:https?):\/\/shazzer[.]co[.]uk/;
Object.getOwnPropertyNames(window).forEach(prop => {
   try{
      regex.test(window[prop]+'')&&log('window.'+prop)
   }catch{}
});
for(const prop in document){
  try{
       regex.test(document[prop]+'')&&log('document.'+prop);
  } catch{}
}

1337