I'm trying to prevent a certain site from being able to use javascript to redirect the browser to another page. The script in question is an inline script so Greasemonkey and adBlock can't do anything about it.

Configurable Security Policies (CAPS) seems to be the answer but I can't get it to work for window.location and all my searches are turning up nothing useful. The script looks like this:

        window.location = "someotherpage.html";

And this is what I've tried in my user.js file:

user_pref("capability.policy.policynames", "noredirect");
user_pref("capability.policy.noredirect.sites", "http://www.zshare.net");        
user_pref("capability.policy.noredirect.Window.Location.replace", "noAccess");
user_pref("capability.policy.noredirect.Window.Location.assign", "noAccess");
user_pref("capability.policy.noredirect.Window.Location.reload", "noAccess");
user_pref("capability.policy.noredirect.Window.Location", "noAccess");
user_pref("capability.policy.noredirect.Document.Location.replace", "noAccess");
user_pref("capability.policy.noredirect.Document.Location.assign", "noAccess");
user_pref("capability.policy.noredirect.Document.Location.reload", "noAccess");
user_pref("capability.policy.noredirect.Document.Location", "noAccess");
user_pref("capability.policy.noredirect.Location.replace", "noAccess");
user_pref("capability.policy.noredirect.Location.assign", "noAccess");
user_pref("capability.policy.noredirect.Location.reload", "noAccess");
user_pref("capability.policy.noredirect.Location", "noAccess");

I've been testing it out on a locally hosted page and I was able to block the alert function, but nothing I try has been able to disable window.location.

Does anyone know how to do this?

  • Just a suggestion, if you are dealing with people who clickjack in this way, what you really need isn't a software solution, it's a different, more honest person to do business with. You can take weeks to implement a solution, then the owner of the website will discover the clickjack is blocked and find another way to screw you. Find a better website, find better people, life is too short to waste on weasels.
    – user224423
    May 15 '13 at 6:14

Although not a Firefox solution to your problem, how about an alternative solution?

In Opera, all you need is a simple regex that will find and replace the script. No complex extension, just a simple user JS file, which would look like this.

Disable redirection 1.00.js:

// ==UserScript==
// @name Disable redirection
// @version 1.00
// @description Disables redirection.
// @namespace http://superuser.com/questions/353339/firefox-disable-window-location-on-website/511703#511703
// @copyright 2012
// @author XP1
// @homepage https://github.com/XP1/
// @license Apache License, Version 2.0; http://www.apache.org/licenses/LICENSE-2.0
// @include http*://example.com/*
// @include http*://*.example.com/*
// ==/UserScript==

 * Copyright 2012 XP1
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *     http://www.apache.org/licenses/LICENSE-2.0
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * See the License for the specific language governing permissions and
 * limitations under the License.

/*jslint browser: true, vars: true, maxerr: 50, indent: 4 */
(function (opera) {
    "use strict";

    var isReplaced = false;

    function replaceJs(userJsEvent) {
        if (isReplaced) {

        var element = userJsEvent.element;
        element.text = element.text.replace(/window\.location = "someotherpage\.html";/g, "");

        isReplaced = true;

    opera.addEventListener("BeforeScript", function listener(userJsEvent) {
        if (isReplaced) {
            opera.removeEventListener("BeforeScript", listener, false);

    }, false);
  • 1
    So I googled that Opera event... turns out this actually existed in firefox since version 4. developer.mozilla.org/en-US/docs/DOM/…. Calling e.stopPropagation and e.preventDefault stops the script from running.
    – Telanor
    Nov 29 '12 at 8:26
  • @Telanor Nice! Although if the script has more code than the window.location, you may want to find and replace instead of stopping the entire script.
    – XP1
    Nov 29 '12 at 23:49

The only foolproof way is to write your own Firefox add-on. Greasemonkey cannot do it because javascript, such as beforeunload, cannot block window.location = "..." redirects.

However, I have blocked sites from doing this using NoScript and/or RequestPolicy. Neither approach is perfect but they may work for you.

  • Ideally use NoScript to block JS for the site. This will stop the window.location.
    Many sites work acceptably without JS. If this site really needs JS, then NoScript won't help you with the location issue. But NoScript, like AdBlock, is great for speeding up the net and cutting back the crud.

  • The next possible fix is to use RequestPolicy. RequestPolicy can block just requests from site_A to site_B for example (while allowing site_B in other circumstances).

    This will work as long as the window.location is to a page on another site. If it's same-site, then the custom add-on is the only alternative.

    Beware that RequestPolicy shuts down most everything, by default, and requires you to whitelist acceptable sites. This means that it requires a fair bit of training/configuration.

    The good part is that it can stop just about all the cross-site shenanigans that are rampant on the web -- which is how Facebook, Google, etc. track your every move and how a lot of security exploits are perpetrated.

  • If the first 2 options won't work, then another possibility is to:

    1. Save a copy of all the page's JS that you want/need.
    2. Edit out any bad parts.
    3. Load that JS into the GM script using the // @require directive or just paste in the code.
    4. Then use NoScript to completely stop the page's JS. This is OK because GM JS will run, even if NoScript blocks the page's JS.
    5. The only drawback is that sometimes the page's JS will need refactoring to port to the GM script. Most of the time it will drop right in, however.

  • If none of the above works, your only option is to write your own FF add-on.

  • NoScript wouldn't work because the site in question requires javascript to run and RequestPolicy wont work either because the site redirects to another page on the same site.
    – Telanor
    Nov 16 '11 at 10:16
  • I added another approach. GM JS will run, even if NoScript blocks the page's JS. That means you can use NoScript, and just replace the page's JS with your sanitized versions. Failing that, then your only alternative is to write your own add-on. Nov 16 '11 at 10:31
  • @Telanor, seems like a lot of work for Firefox. In Opera, all you need is a simple regex that will find and replace the script. No complex extension, just a simple user JS file.
    – XP1
    Nov 28 '12 at 7:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.