Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #14485 > unrolled thread

JS injection in Firefox

Back to article view | Back to comp.lang.javascript

Contents

  JS injection in Firefox Shelly <sheldonlg@thevillages.net> - 2012-06-13 13:31 -0400
    Re: JS injection in Firefox "Tom de Neef" <tdeneef@qolor.nl> - 2012-06-13 20:47 +0200
      Re: JS injection in Firefox Shelly <sheldonlg@thevillages.net> - 2012-06-13 15:32 -0400
        Re: JS injection in Firefox "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2012-06-13 20:02 +0000
          Re: JS injection in Firefox Stefan Weiss <krewecherl@gmail.com> - 2012-06-13 23:16 +0200
            Re: JS injection in Firefox Shelly <sheldonlg@thevillages.net> - 2012-06-13 21:54 -0400
              Re: JS injection in Firefox Stefan Weiss <krewecherl@gmail.com> - 2012-06-14 05:28 +0200
                Re: JS injection in Firefox Shelly <sheldonlg@thevillages.net> - 2012-06-14 08:17 -0400
      Re: JS injection in Firefox Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-06-15 00:55 +0200

#14485 — JS injection in Firefox

I already have this in the Firefox forum, but maybe someone here can help.

I have an application where the AJAX call sends back a javascript and is 
put up in  a <div> tag using innerHTML.  In Feb. 2008 this worked on 
both Firefox and IE.  Now it does not work on IE.

I checked what is sent back to the browser and it is identical for both 
browsers.  From what I have read, it appears that later versions of 
Firefox have blocked the running of scripts coming back from an AJAX 
call.  That appears to be (but I am not certain) my problem.

I have searched the internet and found a few suggestions, but haven't 
been able to make any of them produce the desired result.

Unfortunately, I cannot provide any URL since this for an intranet that 
is behind a firewall that I access via VPN.

If someone can point me to a possible solution, I would be grateful.

-- 
Shelly

[toc] | [next] | [standalone]

#14486

"Shelly" <sheldonlg@thevillages.net> schreef
>
> I have an application where the AJAX call sends back a javascript and is 
> put up in  a <div> tag using innerHTML.  In Feb. 2008 this worked on both 
> Firefox and IE.  Now it does not work on IE.
>

Two days ago, Steafn Weiss answered Jason C in this NG (I don't know how to 
get the ref):
...the answer is that scripts inserted with innerHTML are never evaluated.
...An ... option would be to scan the inserted HTML for script elements and 
manually evaluate them.

Is this relevant to your question?
Tom

[toc] | [prev] | [next] | [standalone]

#14490

On 6/13/2012 2:47 PM, Tom de Neef wrote:
> "Shelly"<sheldonlg@thevillages.net>  schreef
>>
>> I have an application where the AJAX call sends back a javascript and is
>> put up in  a<div>  tag using innerHTML.  In Feb. 2008 this worked on both
>> Firefox and IE.  Now it does not work on IE.
>>
>
> Two days ago, Steafn Weiss answered Jason C in this NG (I don't know how to
> get the ref):
> ...the answer is that scripts inserted with innerHTML are never evaluated.
> ...An ... option would be to scan the inserted HTML for script elements and
> manually evaluate them.
>
> Is this relevant to your question?
> Tom

I found that one.  It said that they are never evaluated.  That is not 
true.  My return uses innerHTML, is a javascript that is returned, and 
evaluates in Internet Explorer.  It used to (Feb. 2008 version) in 
Firefox, but now it doesn't.

-- 
Shelly

[toc] | [prev] | [next] | [standalone]

#14492

Shelly wrote on 13 jun 2012 in comp.lang.javascript:

> On 6/13/2012 2:47 PM, Tom de Neef wrote:
>> "Shelly"<sheldonlg@thevillages.net>  schreef
>>>
>>> I have an application where the AJAX call sends back a javascript
>>> and is put up in  a<div>  tag using innerHTML.  In Feb. 2008 this
>>> worked on both Firefox and IE.  Now it does not work on IE.
>>>
>>
>> Two days ago, Steafn Weiss answered Jason C in this NG (I don't know
>> how to get the ref):
>> ...the answer is that scripts inserted with innerHTML are never
>> evaluated. ...An ... option would be to scan the inserted HTML for
>> script elements and manually evaluate them.
>>
>> Is this relevant to your question?
>> Tom
> 
> I found that one.  It said that they are never evaluated.  That is not
> true.  My return uses innerHTML, is a javascript that is returned, and
> evaluates in Internet Explorer.  It used to (Feb. 2008 version) in 
> Firefox, but now it doesn't.

Does not work in IE9, I cannot believe it ever did.

======== test.html ==========

<div id=d>here</div>

<script type='text/javascript'>

var t = '<script type="text/javascript">alert("hi");</' +
'script>';

alert(t)

document.getElementById('d').innerHTML = t;

</script>

============================


-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#14493

On 2012-06-13 22:02, Evertjan. wrote:
> Shelly wrote on 13 jun 2012 in comp.lang.javascript:
>> On 6/13/2012 2:47 PM, Tom de Neef wrote:
>>> Two days ago, Steafn Weiss answered Jason C in this NG (I don't know
>>> how to get the ref):
>>> ...the answer is that scripts inserted with innerHTML are never
>>> evaluated. ...An ... option would be to scan the inserted HTML for
>>> script elements and manually evaluate them.
...
>> I found that one.  It said that they are never evaluated.  That is not
>> true.  My return uses innerHTML, is a javascript that is returned, and
>> evaluates in Internet Explorer.  It used to (Feb. 2008 version) in 
>> Firefox, but now it doesn't.
> 
> Does not work in IE9, I cannot believe it ever did.

This page from the IE API reference
<http://msdn.microsoft.com/en-us/library/ie/ms533897%28v=vs.85%29.aspx>
has the following information:

| When using innerHTML to insert script, you must include the DEFER
| attribute in the script element.

If Shelly's code used defer, it's possible that the script was indeed
evaluated in IE. I can't explain how it could have worked in Firefox in
2008, though. It couldn't have been the defer attribute, because support
for that was only introduced in Firefox 3.5 (and for a different purpose).

In any case, DEFER doesn't do anything for scripts inserted with
innerHTML in current versions of Firefox or Chrome. Shelly, if you want
to support other browsers than IE, I still refer you to my previous post
in the thread "XMLHttpRequest, using setTimeout() from within child". Or
you could show us the code that worked in Firefox in 2008. Maybe there's
something else going on.

- stefan

[toc] | [prev] | [next] | [standalone]

#14495

On 6/13/2012 5:16 PM, Stefan Weiss wrote:
> On 2012-06-13 22:02, Evertjan. wrote:
>> Shelly wrote on 13 jun 2012 in comp.lang.javascript:
>>> On 6/13/2012 2:47 PM, Tom de Neef wrote:
>>>> Two days ago, Steafn Weiss answered Jason C in this NG (I don't know
>>>> how to get the ref):
>>>> ...the answer is that scripts inserted with innerHTML are never
>>>> evaluated. ...An ... option would be to scan the inserted HTML for
>>>> script elements and manually evaluate them.
> ...
>>> I found that one.  It said that they are never evaluated.  That is not
>>> true.  My return uses innerHTML, is a javascript that is returned, and
>>> evaluates in Internet Explorer.  It used to (Feb. 2008 version) in
>>> Firefox, but now it doesn't.
>>
>> Does not work in IE9, I cannot believe it ever did.
>
> This page from the IE API reference
> <http://msdn.microsoft.com/en-us/library/ie/ms533897%28v=vs.85%29.aspx>
> has the following information:
>
> | When using innerHTML to insert script, you must include the DEFER
> | attribute in the script element.
>
> If Shelly's code used defer, it's possible that the script was indeed
> evaluated in IE. I can't explain how it could have worked in Firefox in
> 2008, though. It couldn't have been the defer attribute, because support
> for that was only introduced in Firefox 3.5 (and for a different purpose).
>
> In any case, DEFER doesn't do anything for scripts inserted with
> innerHTML in current versions of Firefox or Chrome. Shelly, if you want
> to support other browsers than IE, I still refer you to my previous post
> in the thread "XMLHttpRequest, using setTimeout() from within child". Or
> you could show us the code that worked in Firefox in 2008. Maybe there's
> something else going on.
>
> - stefan

I can't show the code (company policy).  I wrote this app starting in 
Jan 2008.  Nothing at all has changed in the code.  I used Firefox to 
develop it because of its Firebug tool.  The browser problems I had at 
that time was making all the features work properly in IE.  For example, 
I put up a popup box that stays fixed in position on the screen even 
when scrolling the window behind the pop-up.  That was a devil to get 
working properly in IR.

Now the company wants to use this again (they hadn't for a a few years). 
  So, I went to see if it still worked.  It does in IE, but not in 
Firefox.  Again, nothing has changed in the interim.

Here is what is returned from the server: 
[{"action":"assign","id":"navbar","attributes":{"innerHTML":"<script 
type='text\/javascript'> var menu = new 
DHTMLSuite.menuModel();menu.addItem('1', 'Main Menu', , , 
false);menu.setSubMenuWidth('1',230);menu.addItem('11', 'pccr', , , 
'1');menu.setSubMenuWidth('11',230);menu.addItem('111', 'Master 
Configuration', , , 
'11');menu.setSubMenuWidth('111',230);menu.addItem('1111', 'Supplier 
Configuration', , , '111', , \"ajaxCall('pccr', 
'SupplierConfigurationController', 'initialize', , 
'dummyCallback')\");menu.addItem('1112', 'Dimension Configuration', , , 
'111', , \"ajaxCall('pccr', 'DimensionConfigurationController', 
'initialize', , )\");menu.addItem('1113', 'Responsible Person', , , 
'111', , \"ajaxCall('pccr', 'ResponsiblePersonConfigurationController', 
'initialize', , )\");menu.addItem('1114', 'Indirect Contracts', , , 
'111', , \"ajaxCall('pccr', 'IndirectContractsController', 'initialize', 
, )\");menu.addItem('1115', 'InterCompany Configuration', , , '111', , 
\"ajaxCall('pccr', 'InterCompanyConfigurationController', 'initialize', 
, )\");menu.addItem('112', 'Current Period Review', , , '11', , 
\"ajaxCall('pccr', 'CurrentPeriodReviewController', 'initialize', , 
)\");menu.addItem('113', 'PCCR History', , , '11', , \"ajaxCall('pccr', 
'PccrHistoryController', 'initialize', , )\");menu.init(); var menuBar2 
= new 
DHTMLSuite.menuBar();menuBar2.addMenuItems(menu);menuBar2.setTarget('navbar');menuBar2.init();<\/script>"}}] 


This is what is sent back by both IE and Firefox.  The result is a drop 
down menu system in IE and a null in Firefox.

-- 
Shelly

[toc] | [prev] | [next] | [standalone]

#14496

On 2012-06-14 03:54, Shelly wrote:
> On 6/13/2012 5:16 PM, Stefan Weiss wrote:
>> Or you could show us the code that worked in Firefox in 2008. Maybe
>> there's something else going on.
...
> I can't show the code (company policy).  I wrote this app starting in 
> Jan 2008.  Nothing at all has changed in the code.  I used Firefox to 
> develop it because of its Firebug tool.  The browser problems I had at 
> that time was making all the features work properly in IE.  For example, 
> I put up a popup box that stays fixed in position on the screen even 
> when scrolling the window behind the pop-up.  That was a devil to get 
> working properly in IR.
> 
> Now the company wants to use this again (they hadn't for a a few years). 
>   So, I went to see if it still worked.  It does in IE, but not in 
> Firefox.  Again, nothing has changed in the interim.
> 
> Here is what is returned from the server:
[...]

Since you were using Firebug when you wrote the code back then, I'm
going to assume you know how to detect JS errors and warnings.

The code you posted doesn't really help; it's just JSON with an
"innerHTML" key containing a script. I suppose something could have gone
wrong with the DHTMLSuite scripts, but I don't know that library. It
would have been more interesting to see how the script gets added to the
document.

There's really not much I can do at this point. A script that worked in
2008 but fails now, without errors or warnings... The only thing that
comes to mind is that quirks mode was much more prevalent then, but
that's more likely to produce rendering errors than nothing at all.

You could try to replace the script contents (in the JSON response) with
something simple like "alert(1)", and see if that gets evaluated. Other
than that, check if there's a new version of this DHTMLSuite thingie,
maybe that helps. According to the dhtmlgoodies site, the current
version was "Last updated: July. 10th. 2009: Bugfix for Firefox 3.5.".

- stefan

[toc] | [prev] | [next] | [standalone]

#14500

On 6/13/2012 11:28 PM, Stefan Weiss wrote:
> On 2012-06-14 03:54, Shelly wrote:
>> On 6/13/2012 5:16 PM, Stefan Weiss wrote:
>>> Or you could show us the code that worked in Firefox in 2008. Maybe
>>> there's something else going on.
> ...
>> I can't show the code (company policy).  I wrote this app starting in
>> Jan 2008.  Nothing at all has changed in the code.  I used Firefox to
>> develop it because of its Firebug tool.  The browser problems I had at
>> that time was making all the features work properly in IE.  For example,
>> I put up a popup box that stays fixed in position on the screen even
>> when scrolling the window behind the pop-up.  That was a devil to get
>> working properly in IR.
>>
>> Now the company wants to use this again (they hadn't for a a few years).
>>    So, I went to see if it still worked.  It does in IE, but not in
>> Firefox.  Again, nothing has changed in the interim.
>>
>> Here is what is returned from the server:
> [...]
>
> Since you were using Firebug when you wrote the code back then, I'm
> going to assume you know how to detect JS errors and warnings.
>
> The code you posted doesn't really help; it's just JSON with an
> "innerHTML" key containing a script. I suppose something could have gone
> wrong with the DHTMLSuite scripts, but I don't know that library. It
> would have been more interesting to see how the script gets added to the
> document.
>
> There's really not much I can do at this point. A script that worked in
> 2008 but fails now, without errors or warnings... The only thing that
> comes to mind is that quirks mode was much more prevalent then, but
> that's more likely to produce rendering errors than nothing at all.
>
> You could try to replace the script contents (in the JSON response) with
> something simple like "alert(1)", and see if that gets evaluated. Other
> than that, check if there's a new version of this DHTMLSuite thingie,
> maybe that helps. According to the dhtmlgoodies site, the current
> version was "Last updated: July. 10th. 2009: Bugfix for Firefox 3.5.".
>
> - stefan

Thanks.  I put up what was sent back just to show what it was like, not 
that I expected it to help.  I can look to see if there is a later 
version of the suite that might work with later versions of Firefox.  I 
like your idea of sending back an alert.  I'll try that.

-- 
Shelly

[toc] | [prev] | [next] | [standalone]

#14504

Tom de Neef wrote:

> "Shelly" <sheldonlg@thevillages.net> schreef
>> I have an application where the AJAX call sends back a javascript and is
>> put up in  a <div> tag using innerHTML.  In Feb. 2008 this worked on both
>> Firefox and IE.  Now it does not work on IE.
> 
> Two days ago, Steafn Weiss answered Jason C in this NG (I don't know how
> to get the ref):
> […]

Use View → Source to get the Message-ID, or get better software, for example 
Thunderbird or KNode.  Use <news:$msgid> for best compatibility; in this 
case, <news:jr4g80$7k2$1@news.albasani.net>.


PointedEars
-- 
Use any version of Microsoft Frontpage to create your site.
(This won't prevent people from viewing your source, but no one
will want to steal it.)
  -- from <http://www.vortex-webdesign.com/help/hidesource.htm> (404-comp.)

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web