阻止任何第三方javascript代碼訪問href url

我在我的頁面上運行第三方javascript，他們在未經我同意的情況下抓取了href網址。有沒有辦法阻止它，並避免他們訪問它，而無需從iframe中調用它們？阻止任何第三方javascript代碼訪問href url

也許我可以重新定義window.location.href的值，以便它們無法訪問它，因爲它在URL中？

謝謝您的幫助！

2015-09-24 Rui Filipe de Freitas

沒有使用這種垃圾郵件的第三方庫的選項 - 找到一個更好的？ –

我希望但他們正在爲我的廣告收入的很大一部分，所以不是真的:( –

location.href屬性是隻讀的。我只能用這個部分解決方案來使用這個計算器中列出的greasemonkey腳本的修改版本：Stop execution of Javascript function (client side) or tweak it

在下面的腳本中調用了函數displayUrl（），它將document.location.href提醒到屏幕。 greasemonkey腳本使用Document.onbeforescriptexecute事件在JavaScript執行前攔截javascript，並將document.location.href替換爲另一個字符串。

onbeforescriptexecute只有Firefox支持和是非標準的：https://developer.mozilla.org/en-US/docs/Web/API/Document/onbeforescriptexecute

所以不完全是一個理想的解決方案，但這個例子可以給你一些想法。

<html> 
<head> 
</head> 
<body> 
<script> 

function checkForBadJavascripts (controlArray) { 

    /*--- Note that this is a self-initializing function. The controlArray 
     parameter is only active for the FIRST call. After that, it is an 
     event listener. 

     The control array row is defines like so: 
     [bSearchSrcAttr, identifyingRegex, callbackFunction] 
     Where: 
      bSearchSrcAttr  True to search the SRC attribute of a script tag 
           false to search the TEXT content of a script tag. 
      identifyingRegex A valid regular expression that should be unique 
           to that particular script tag. 
      callbackFunction An optional function to execute when the script is 
           found. Use null if not needed. 
    */ 
    if (! controlArray.length) return null; 

    checkForBadJavascripts  = function (zEvent) { 

     for (var J = controlArray.length - 1; J >= 0; --J) { 
      var bSearchSrcAttr  = controlArray[J][0]; 
      var identifyingRegex = controlArray[J][1]; 

      if (bSearchSrcAttr) { 

       if (identifyingRegex.test (zEvent.target.src)) { 
        stopBadJavascript (J); 
        return false; 
       } 
      } 
      else { 
       if (identifyingRegex.test (zEvent.target.textContent)) { 
        stopBadJavascript (J); 
        return false; 
       } 
      } 
     } 

     function stopBadJavascript (controlIndex) { 
      zEvent.stopPropagation(); 
      zEvent.preventDefault(); 

      var callbackFunction = controlArray[J][2]; 
      //if (typeof callbackFunction == "function") { 
       //callbackFunction(); 

       if (bSearchSrcAttr) { 
        var jsScript = zEvent.target.src; 
       } else { 
        var jsScript = zEvent.target.textContent; 
       } 

       jsScript = jsScript.replace("document.location.href", "'http://example.com'"); 
       eval(jsScript); 
      //} 

      //--- Remove the node just to clear clutter from Firebug inspection. 
      zEvent.target.parentNode.removeChild (zEvent.target); 

      //--- Script is intercepted, remove it from the list. 
      controlArray.splice (J, 1); 
      if (! controlArray.length) { 
       //--- All done, remove the listener. 
       window.removeEventListener (
        'beforescriptexecute', checkForBadJavascripts, true 
       ); 
      } 
     } 
    } 

    /*--- Use the "beforescriptexecute" event to monitor scipts as they are loaded. 
     See https://developer.mozilla.org/en/DOM/element.onbeforescriptexecute 
     Note that it does not work on acripts that are dynamically created. 
    */ 
    window.addEventListener ('beforescriptexecute', checkForBadJavascripts, true); 

    return checkForBadJavascripts; 
} 

function addJS_Node (text, s_URL, funcToRun) { 
    var D         = document; 
    var scriptNode       = D.createElement ('script'); 
    scriptNode.type       = "text/javascript"; 
    if (text)  scriptNode.textContent = text; 
    if (s_URL)  scriptNode.src   = s_URL; 
    if (funcToRun) scriptNode.textContent = '(' + funcToRun.toString() + ')()'; 

    var targ = D.getElementsByTagName ('head')[0] || D.body || D.documentElement; 
    //--- Don't error check here. if DOM not available, should throw error. 
    targ.appendChild (scriptNode); 
} 

/*--- Check for bad scripts to intercept and specify any actions to take. 
*/ 
checkForBadJavascripts ([ 
    [ false, 
     /document.location.href/, 
     function() { 
      addJS_Node (replaceScript); 
     } 
    ] 
]); 

</script> 

<script> 
function displayUrl() 
{ 
    var pageUrl = document.location.href; 

    alert(pageUrl); 
} 

displayUrl(); 
</script> 
</body> 
</html>

注：我已經添加下面的代碼到原來的Greasemonkey腳本：

//if (typeof callbackFunction == "function") { 
     //callbackFunction(); 

     if (bSearchSrcAttr) { 
      var jsScript = zEvent.target.src; 
     } else { 
      var jsScript = zEvent.target.textContent; 
     } 

     jsScript = jsScript.replace("document.location.href", "'http://example.com'"); 
     eval(jsScript); 
    //}

來源

2015-09-24 11:55:46 thebrokenone937

謝謝我會嘗試此解決方案，並進一步調查，看看是否有辦法與其他瀏覽器做類似的事情:) –

阻止任何第三方javascript代碼訪問href url

回答

相關問題