Hack the behaviour of window.location.replace, use a javascript instead of URL

Question

Is it possible in some way to hack the behaviour of window.location.replace, to fire a JavaScript function (let's say alert) instead of making the user go to the new location?

I'll give you the example, let's say we have this function:

setTimeout(function(){ window.location.replace("#SOMETHING_HERE#"); }, 900);

this is fired when a user clicks on a specific button; the #SOMETHING_HERE# is a placeholder, the administrator can put there a URL via a configuration panel.

Now, we all know clients are weird, and mine has just asked me to find a way to fire a JavaScript instead of redirect the user, well, I'm stuck. Of course I should modify the function bound to the button, but actually I have no access to the code and the only entry point is that panel I've mentioned before, I can only change the value of #SOMETHING_HERE#. Do someone has some clues on how I could for example fire an alert("foo"); ? is that possible in some way?

the answer could be also "NO" and I'll simply say them that we have to find a way to change that code.

Client is not being weird here since I don't think client would have asked you to use ocation.replace at first place. Why can't you invoke location.replace conditionaly? — gurvinder372
– gurvinder372, Commented Feb 2, 2016 at 13:54
the code isn't mine and I don't know the workflow and decisions taken when it was first written :( — Matteo Bononi 'peorthyr'
– Matteo Bononi 'peorthyr', Commented Feb 2, 2016 at 13:56
LOL the only real solution is to inject javascript through a "we-are-lucky-this-allows-xss!" control panel (the first comment here on top)... WOW. Tell client that this is what happens when you don't have a budget for a web application. Hacks will get you nowhere and this is a maintenance nightmare. — Sharky
– Sharky, Commented Feb 2, 2016 at 13:58

Community · Accepted Answer · 2020-06-20 09:12:55Z

8

You can prefix your string with javascript::

setTimeout(function(){ window.location.replace("javascript:alert('hello world!')"); }, 900);

This works because the spec for location.replace ends up at the definition for "navigate", which says:

This is the step that attempts to obtain the resource, if necessary. Jump to the first appropriate substep:

...

If the new resource is a URL whose scheme is javascript

Queue a task to run these "javascript: URL" steps, associated with the active document of the browsing context being navigated:

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Feb 2, 2016 at 13:52

James Thorpe

32.3k6 gold badges76 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Matteo Bononi 'peorthyr' Over a year ago

this is perfect, really really thanks, also for the informations!

Collectives™ on Stack Overflow

Hack the behaviour of window.location.replace, use a javascript instead of URL

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related