Preventing JavaScript code from running by removing from the page source at runtime

Question

Somebody entered XSS code in my friend's site. It inserts <script>alert(0)</script> in the page source. You can see it here.

Is there a way to remove this from the page at runtime, to prevent it from being executed?

He has a presentation on it tomorrow and he has no access to database to remove it.

You could use the same xss vulnerability to remove it that the other person used to add it, — user400654
– user400654, Commented Apr 16, 2013 at 18:42
Why not fix the code to properly escape output? If it's his site, clearly he should be able to update it. — Interrobang
– Interrobang, Commented Apr 16, 2013 at 18:49
the username and password for the db is probably in some plain text file somewhere that lets the page access the data. — John Boker
– John Boker, Commented Apr 16, 2013 at 19:05

Alan Moran · Accepted Answer · 2013-04-16 18:58:28Z

2

As a really quick fix. If he has access to the javascript he could do a simple trick like below.

   alert = function() {}

This will stop all alerts from firing.

edited Apr 16, 2013 at 18:58

answered Apr 16, 2013 at 18:48

Alan Moran

313 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ian Over a year ago

You definitely can't put it in $(function () { }); because that'll be too later to overwrite alert. I'd go back to your original and not include your change, and make sure it's run as soon as possible on the page.

John Boker · Accepted Answer · 2013-04-16 19:19:56Z

0

You can disable alert on http://technoflexusdatastreamapi.appspot.com/landingpage before loading the data:

$('.viewDataLink').click(function ()
{
    $("#scriptShow").hide();
    $("#showData").show();
    $("#progressAnimation").show();
    var tmpAlert = alert;
    window.alert = function () { };
    $("#showData").load("/listData", function (response, status, xhr)
    {
        if (status == "success")
        {
            $("#progressAnimation").hide();
            window.alert = tmpAlert;
        }
    });
});

answered Apr 16, 2013 at 19:19

John Boker

83.8k17 gold badges101 silver badges130 bronze badges

Collectives™ on Stack Overflow

Preventing JavaScript code from running by removing from the page source at runtime

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related