4 ms·
This has convinced me to take precautions. I am adding some logic to my site that if there are more than two script tags (I only have 2) replace body content wi
by austincheney 8y ago
This has convinced me to take precautions. I am adding some logic to my site that if there are more than two script tags (I only have 2) replace body content with error text and send an xhr notification back to the server so that the server will know their pages are compromised
It’s as simple as document.getElementsByTagName(“script”).length
EDIT:
Here is my tested more sane approach: https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0c276d62 https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0...
I do not have an xhr notification in place in the gist, because I have not written a service to receive it yet.
- ATsch 8y agoYou could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP violations.
- austincheney 8y agoCSP wont help you if you authorize scripts with a source of self or if the malicious script contains a relative "src" attribute. This approach has the added benefit of letting you know that malicious things are happening.
- lozenge 8y agoCSP has report options.
- franciscop 8y agoWhat about those plugins that the user chose and add a script tag? While they should be becoming less common (since I read it's a bad practice), they are still out there.
- im3w1l 8y agoDid you consider a "silent alarm", that only phones home without displaying an error?
- austincheney 8y agoNo. Perhaps the most important part of this is keeping the user informed.
- mehrdadn 8y agoWhat do you think most users would (and should) do if they were told your hosting provider was injecting scripts into the page? Stop using your site?
- zbentley 8y agoHopefully. The alternative (silently alert and hope I pick up the phone) might not be so bad for users if a hosting provider is running analytics or ads, but from a detect-and-alert perspective it's pretty hard to tell the difference between a scummy-hosting-provider script and a credential-scraping bonafide hack. Many people (or robots) who install the latter aren't smart enough to defeat alerting measures, so it's a big benefit if those measures warn the users directly.
- austincheney 8y agoYour question is the difference between marketing and craftsmanship. Are you primarily proud of your product or trying to increase your traffic?