To isolate user-defined properties in the window object, you can compare the current keys of window against a "clean" iframe context. This effectively filters out all browser-native APIs and built-ins.
Here is a concise snippet you can paste directly into your console:
((win) => {
const iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
const nativeProps = Object.getOwnPropertyNames(iframe.contentWindow);
document.body.removeChild(iframe);
const userProps = Object.getOwnPropertyNames(win)
.filter(prop => !nativeProps.includes(prop));
console.log("User-defined properties:", userProps);
userProps.forEach(p => console.log(p, '=>', win[p]));
})(window);- The Sandbox: It creates a temporary, empty
iframewhich contains a pristinewindowobject. Any property present in this frame is considered "native" to the environment. - The Filter: It gets all property names from the actual
windowand filters out anything that exists in the cleaniframecontext. - Safety: By logging the keys first and then accessing the values, it avoids the
JSON.stringifycircular reference trap while still allowing you to inspect the values directly in the console.
- Scope: If you are running this on a page with heavy security headers (CSP), ensure the
iframecreation is permitted. - Dynamic Data: If a library attaches properties lazily, you may want to wrap this in a
setTimeoutif you suspect the script hasn't finished loading yet.