Is it possible to override somehow document.location.href ?
need override getter, ex.: alert(document.location.href); should return lets say "www.example.com" while real document location is www.stackoverflow.com...
don't know is it possible..
What security reasons? I can't think of one right now.
Georg
2010-01-11 15:54:50
gs: You could set up a fake Facebook sign-in page and the change the URL onload.
Jan Aagaard
2010-01-11 16:05:00
This actually depends on the browser. Some browsers will allow you to replace the location object and fake the return from this API. Websites should not rely upon this object as a means of protecting from attack.
EricLaw -MSFT-
2010-01-11 16:06:14
There's no connection between the javascript variables and the URL. Returning wrong data from `document.location` doesn't affect the URL field of the browser.
Georg
2010-01-11 16:08:26
+1
A:
No, but...
In Ecmascript 5, there is support for getters/setters and you can spoof the document reference if accessed from within a scope which redefines it.
Proof:
(function (document) {
alert(document); // -> "spoofed document"
})("spoofed document");
Combined with accessors you can replace the document object. (Javascript 1.5 is needed for accessors.)
Mikuso
2010-01-11 15:49:49
Note that it's still easy to break out of this sandbox using various commands which perform an `eval()` internally or directly using `eval()`. For an example see here: http://jsbin.com/esula/edit
Georg
2010-01-11 16:15:19
A:
As others already have noted it is not possible to change the URL without reloading the page.
Note that you can the change the fragment identifier, i.e. the part in the URL after the hash (#) using document.location.hash, but that is probably not good enough for you.
Jan Aagaard
2010-01-11 16:03:27
A:
Swap out "document" to another variable, edit it, and swap it back in.
var d = {}
for (var k in document) {
d[k] = document[k];
}
d["location"]="out of this world";
document = d;
mparaz
2010-05-26 13:54:22