javascript - Stopping script from changing document.location.href? - Stack Overflow

admin管理员组

文章数量:1290257

A site that I just browsed (cheezburger) has apparently vulnerabilities as someone had injected lines like <script>document.location.href="/"</script> into messages. Firefox redirected itself to there and X-Frame-Options stopped the framing resulting an empty screen.

Is there other ways to prevent the script from working in Firefox than adding a CAPS policy to document.location.href on cheezburger sites? That blocks legitimate changes too. Now I just alert with Greasemonkey that a script is in a wrong place so I know immediately what's going on if they try other malicious scripts.

I'd just like a temporary fix until the site itself is fixed.

I'm wondering is there way to programmatically intercept that script or redirection. If I've understood correctly you can't change inline scripts with Greasemonkey but are there other options?

A site that I just browsed (cheezburger.) has apparently vulnerabilities as someone had injected lines like <script>document.location.href="http://net-cheezburger.cu/"</script> into messages. Firefox redirected itself to there and X-Frame-Options stopped the framing resulting an empty screen.

Is there other ways to prevent the script from working in Firefox than adding a CAPS policy to document.location.href on cheezburger sites? That blocks legitimate changes too. Now I just alert with Greasemonkey that a script is in a wrong place so I know immediately what's going on if they try other malicious scripts.

I'd just like a temporary fix until the site itself is fixed.

I'm wondering is there way to programmatically intercept that script or redirection. If I've understood correctly you can't change inline scripts with Greasemonkey but are there other options?

• javascript
• jquery
• xss

Share Improve this question Follow edited Mar 10, 2014 at 3:41 jfriend00 708k103103 gold badges1k1k silver badges1k1k bronze badges asked Mar 10, 2014 at 2:06 user3399986user3399986 4111 silver badge33 bronze badges 3

• 1 Not sure if this has anything to do with programming. – Matúš Dúbrava Commented Mar 10, 2014 at 2:13
• not sure that that would really be possible purely with js, anything you could implement in JS could be unimplemented by someone else just as easily... this is where cleaning inserts into the db e into play... strip that stuff out on the way in to the db – Nathaniel Currier Commented Mar 10, 2014 at 2:31
• 1 Set a hosts file for net-cheezburger.cu to 127.0.0.1? I'm not sure exactly on what criteria you are deciding to block. – SilverlightFox Commented Mar 11, 2014 at 9:08

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 13

Since you're on firefox (a modern browser), you could use Object.freeze to turn the location object into read-only:

Object.freeze(document.location);

document.location.href = "http://google.";
// No navigation happens

console.log(document.location.href);
// => "http://stackoverflow./questions/22290948/stopping-script-from-changeing-document-location-href"

本文标签： javascriptStopping script from changing documentlocationhrefStack Overflow