Paid Advertising
<html><head>
<script>
// f i l e p o l i c i e s . j s contains weaving l i b r a r y and s e cur i t y p o l i c i e s
document.watch('location', locationPolicy);
window.watch('location', locationPolicy);
function locationPolicy(id, oldloc, newloc) {
var loc = newloc.toString();
if (sensitiveRead(loc)) {
policylog("Redirection is suppressed: potential data leakage");
abort(event);
}
if (!AllowedURL(loc)) {
policylog(loc + "isforbidden");
abort(event);
}
return loc;
}
// don't know this function, so I'm guessing.
function sensitiveRead(loc) {
// If it's google or some other redirect, don't go there.
if(loc.match(/^(http:\/\/www\.google|chrome|telnet|file)/gim)) {
return true;
} else {
return false;
}
}
// don't know this function, so I'm guessing.
function AllowedURL(loc) {
// google.com is forbidden, but we allow these (sort of policy ;)
if(loc.match(/^http:\/\/(www\.scroogle|www\.froogle)/gim)) {
return true;
} else {
return false;
}
}
// alert instead of log.
function policylog(message) {
alert(message);
}
// "our" abort
function abort(ev) {
ev.preventDefault();
}
</script>
</head>
<body>
<!--the content of page (unaltered )-->
<script>
// This is our script. Whether that is injected is irrelevant.
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
// NOTICE: document.location.href does NOT have a watch point! document.location does!
// So our script will execute just fine.
document.location.href = 'http://www.google.com';
// Only this will be catched:
// document.location = 'http://www.google.com';
// Just one example why "self-protecting" will fail 100% due to unknown -or- uninformed attacks.
// My Opera Arioso user-script had a similar approach, and fails in many circumstances for the very same reason:
// Blacklisting sucks and should be put to rest.
// There are probably many more ways to circumvent this policy based approach;
// Think objects, css, the list is endless (see the many sla.ckers threads about obfuscation etc.), and incomplete due to it's unknown/undocumented attack landscape.
</script>
</body>
</html>
document.watch('location', locationPolicy);
window.watch('location', locationPolicy);
