User:Platonides/antilocalXSS.js

Note: After saving, you have to bypass your browser's cache to see the changes. Internet Explorer: press Ctrl-F5, Mozilla: hold down Shift while clicking Reload (or press Ctrl-Shift-R), Opera/Konqueror: press F5, Safari: hold down Shift + Alt while clicking Reload, Chrome: hold down Shift while clicking Reload.

Documentation for this user script can be added at User:Platonides/antilocalXSS.

Report page listing warnings and errors.

/* This guards us against badformed links on this wiki

Author: [[User:Platonides]]

Reference URL [[User:Platonides/antilocalXSS.js]]
*/

//<pre><nowiki>

function Check4MaliciousLinks() {
document.getElementById('jump-to-nav').innerHTML=""; //Not very clean... but the links on this (hidden) div are problematic combined with other scripts (they are links to #something)
//iterate thorugh all links on content
var Malicious = "";
for (var i=0; a = document.getElementById('bodyContent').getElementsByTagName("a")[i]; i++) {
  if (((a.href.indexOf('&script=') != -1) || (a.href.indexOf('&fakeaction=') != -1)) && (a.onclick == undefined)) {
  //If it has a.onclick it's probably a link on the editButtons which have href to #
      //¡It's dangerous!
      Malicious += "\n-" + a.href;
      //Changing for something inocuous
      a.href="http://commons.wikimedia.org/wiki/User_talk:Platonides/antilocalXSS.js";

      //Warn the user
   }
}
if (Malicious != "")
      alert("A dangerous link (potential XSS exploit) has been found and deactivated on this page. Please inform an admin." + Malicious);
}
$(Check4MaliciousLinks);
//</nowiki></pre>