unstoppable onBlur

Mar 21, 2010 1:11am

Hello, thats html that i decided to hook:

<html><head>
window.onblur=function()
{
alert('try to block me!');
}
</head><body></body></html>

I've made 2 scripts, 1st doesnt work at all, so here only 2nd:

// ==UserScript==
// @name test2
// @include *
// ==/UserScript==

function newblur() {

event.stopPropagation();
event.preventDefault();
}

window.addEventListener('blur', newblur, true);

HTMLFormElement.prototype._blur = HTMLFormElement.prototype.blur;
HTMLFormElement.prototype.blur = newblur;

This script works partially (hooks something, like alt+tab defocusing, but still being vulnerable by defocusing with mouse click).

Whats wrong, how complitely disable blur event?

Mar 21, 2010 1:55am

JoeSimmons Scriptwright

unsafeWindow.onblur = null;

Mar 21, 2010 9:08am

scriptonator User

Thanks Joe, but now the opposite situation
"it hooks defocusing by internal mouse clicking, but vulnerable to external alt+tab" :)

Mar 21, 2010 9:15am

JoeSimmons Scriptwright

im not understanding you. what else do you need?

Mar 21, 2010 10:05am

scriptonator User

Just to avoid alert window at ANY situation like mouseclicks, alt+tabs, etc(fully disable onblur event):

<html><head>
window.onblur=function()
{
alert('try to block me!');
}
</head><body></body></html>

Maybe there is a way to replace source code with greasemonkey?
Like replacing "window.onblur" with some trash "window.jikjikblur"

Mar 21, 2010 10:43am

JoeSimmons Scriptwright

my code above stops that. there must be something else doing it. whats the page?

Mar 21, 2010 10:51am

scriptonator User

Tested with firefox 3.0.1 & 3.5.8 and greasemonkey 0.8.20100211.5 (when doing alt+tab and then back to the browser - nasty alert still appears).

The "test page" is exactly what I had written in previous post, running as file://

Mar 21, 2010 11:06am

JoeSimmons Scriptwright

works fine on my test page. by the way, your page code doesnt even work. i used that exact code and it showed the function as text on my page.

Mar 21, 2010 11:08am

scriptonator User

Tested also on 3.6, the same :(
Didnt saw, forum obfuscated script tag, so i will replace it with "<sript>"...

<html><head>
<sript>
    window.onblur=function()
    {   
	alert('try to block me!');
    }
</sript>
</head><body></body></html>

What browser version do you use?</sript>

Mar 21, 2010 11:58am

scriptonator User

Look, I also made new - replacing script.
But it doesnt replacing inside "head" tag. I guess some mistake with "/head/*" ?

// ==UserScript==
// @name           antiblur
// @include        *
// ==/UserScript==
textNodes = document.evaluate(
  "/head/*",
  document,
  null,
  XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE,
  null);
var searchRE = new RegExp('onblur','gi');
var replace = 'fuckblur';
for (var i=0;i<textNodes.snapshotLength;i++) {
  var node = textNodes.snapshotItem(i);
  node.data = node.data.replace(searchRE, replace);
}

Mar 21, 2010 9:19pm

Avindra V.G. Scriptwright

Replacing or removing text within script tags achieves nothing in terms of scripting. Additionally, /head/ is wrong because the document starts with html, so you should use /html/head/.

Mar 21, 2010 9:44pm

Marti Scriptwright

scriptonator wrote:

...
var allNodes = document.evaluate(
  "/head/*",
  document.documentElement,
  null,
  XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE,
  null
);
...

This should work with the existing logic and is more accurate on usage of document.evaluate... AVG's comment is correct within that contextNode. You might need this too.

Mar 22, 2010 12:11am

scriptonator User

So must I return to unsuccessful disabling "window.onblur event" by hooking it instead of replacing?

Mar 28, 2010 1:40pm

scriptonator User

nobody knows? :(
How to disable all nasty activity of such code
(sript = script)

<html><head>
<sript>
    window.onblur=function()
    {   
	alert('try to block me!');
    }
</sript>
</head><body></body></html>

Mar 28, 2010 4:33pm

JoeSimmons Scriptwright

scriptonator wrote:
nobody knows? :(

How to disable all nasty activity of such code

unsafeWindow.onblur = null;

this works perfectly fine. u must be doing something wrong

Mar 28, 2010 6:52pm

LouCypher Scriptwright

scriptonator wrote:
The "test page" is exactly what I had written in previous post, running as file://

...and have you set fileIsGreaseable to true in about:config?

Mar 28, 2010 8:41pm

scriptonator User

LouCypher, can I kiss you :D
JoeSimmons thanks, now works!

Userscripts.org

Presentational HTML allowed.

Use `<code>` for inline code and `<pre>` for code blocks. Use `<` and `>` for literal < and >.

We help break paragraphs and link your links.

Voices

Userscripts.org