Please disable JavaScript to view this site

Post by danielearwicker » Mon, Nov 30, 2020, 4:34 PM UTC

g5095 wrote: post #214

javascript-golf challenge: expose the content of heydonworks.com from the browser console using only javascript.

    fetch("https://heydonworks.com").then(x => x.text()).then(x => { 
      var f = document.createElement("iframe"); 
      document.body.append(f); 
      f.style.left = "0px";
      f.style.top = "0px";
      f.style.width = "100%";
      f.style.height = "100%";
      f.style.position = "absolute"; 
      f.style.border = 0;
      x = x.replace(/\/gi, ""); 
      x = x.replace(/\.*\/gi, ""); 
      f.contentDocument.write(x); 
    });

Post by h_anna_h » Mon, Nov 30, 2020, 5:28 PM UTC

chrismorgan wrote: post #242

Arnavion wrote: post #169

Earlier quoted context omitted.

You need something to enable the ` ` content to be rendered, like a uBO dynamic rule `no-scripting: $hostname true`. uM doesn't do that.

I think it depends on how you disable it. Anecdotally, I think it’s “if no scripts are executed on the page, render content, but if any scripts at all are executed, don’t”.

Post by teknopurge » Mon, Nov 30, 2020, 6:32 PM UTC

charrondev wrote: post #138

teknopurge wrote: post #132

Earlier quoted context omitted.

https does not 100% prevent any of those things.

How can someone spoof the page/inject ads if the site is served over https? They would need to have compromised one of the root certificates on your machine to not give you a giant security warning. In modern browsers there’s not even a button to bypass them (although I know I chrome you can type “this is unsafe” to a hidden input in the error page and it will let you bypass it temporarily).

Post by [deleted] » Mon, Nov 30, 2020, 8:41 PM UTC

capableweb wrote: post #22

usr1106 wrote: post #13

So running untrusted code on your computer is a bad thing. Well, it should be in a sandbox, but that has many intentional and proably some less intentional holes to do stuff on your machine. So how do I trace what Javascript is doing on my machine? Generally mitmproxy gives a feeling what sites the browser talks too. And strace gives often a good feeling what a Linux binary does. But the browser is too big and compli…

> Can anybody recommend a tool to look what Javascript code loaded by a certain page is doing? Open your browser's developer tools, go to the Script/Debugger tab and have at it. It's just about as obtuse to use as a tool as gdb, but you'll see exactly what it does. Chrome dev tools has automatic formatting of the code, maybe firefox too. But you'll be stuck with shitty variable names if they been mangled. Although yo…

Post by intrasight » Mon, Nov 30, 2020, 11:22 PM UTC

shadowoflight wrote: post #150

intrasight wrote: post #142

Earlier quoted context omitted.

I generally visit web pages with JavaScript disabled and them immediately click "reader view". But there are certainly a lot of sites where content is loaded with script, and for those pages I must enabled JS. Q: Does anyone know of a Safari iOS add-in that allows for whitelisting of specific sites to run JS?

Not sure if this solves your entire problem, but you can disable all content blockers for any sit in Safari for iOS[1]. [1]: https://www.macrumors.com/how-to/disable-content-blockers-sa...