Block “document.location” Javascript redirect on one page

Question

I have a site where I want to prevent the page from reloading using a document.location in a script tag. How can I do this in Firefox?

Answer 1

The GreaseMonkey add-on for Firefox is designed to do exactly that.

Answer 2

Actually, Greasemonkey will not block if the HTML code contains an inline javascript block with a redirect like so:

<script type="text/javascript">
var url = "http://google.com";
document.location.replace(url);
</script>

Greasemonkey, however can be used to block calls to specific functions -- just overwrite them :). If the above were wrapped into a function call like so:

<script type="text/javascript">
function redirect_to(url)
{
  document.location.replace(url);
}
</script>

Then you could just redefine the function in Greasemonkey:

function redirect_to(url){ return true }

Block inline redirects via Firefox

Essentially Firefox makes it possible to block any DOM manipulation like location.href.replace from a specific site via so-called: Configurable Security Policies (CAPS)

A word of warning: Note that your security settings will then block ALL calls from that domain for location.href.replace. If any application makes use of that call, there is no way to allow some of the calls and block others.

Setting up CAPS to block location.href.replace

You do not need Greasemonkey for this task. Firefox comes with a built-in capability for allowing/disallowing access to properties/methods of DOM Objects on a per-site basis. It is called Configurable Security Policies (CAPS) and it is described in 1.

A short guide assuming the simplest case:

1. Close Firefox
2. Locate your profile folder
3. Locate the file user.js within this folder. If it does not exist, create it with a text editor (Notepad, vim, etc.)

4. Add the following lines to user.js:

   user_pref("capability.policy.policynames", "noframebuster"); user_pref("capability.policy.noframebuster.sites", "http://www.annoying-site.com"); user_pref("capability.policy.noframebuster.Location.replace", "noAccess");

Of course, you will have to replace the domain with the one you want to prevent from redirecting your frames.

Find a more thorough explanation from my blog (justaddwater.dk): Firefox Tip For Framebuster JavaScript.

Answer 3

Try the YesScript extention.

YesScript lets you make a blacklist of sites that aren't allowed to run JavaScript.