2

I discovered recently, that in chrome, if you write out your scripts in <script> tags, and at the top or bottom of the script tag, have something to delete the tag, the code(setInterval, setTimeout, are the only ones tested) will persist, and keep running, even after the tag is gone. All code in the script tag does get run. For example:

<div id="reload">Loading...</div>
<script id="removeme">
$("#removeme").remove();
setInterval(function(){$("#reload").load("random_number_gen.php");}, 1000);
</script>

In this example, the script is removed as soon as the script starts parsing code, and then an interval is set, for a server side random number generator, that constantly returns a different number into the div. It will keep changing every second into infinity, but the script tag is gone.

Onto the point: Does doing this have any pros or cons? Does doing this secure your javascript code in any way? Obviously javascript can be disabled, and then the user could see the code, but I can think of ways around that.

TL;DR: Does removing a script tag cause any problems? Does it have any drawbacks, or advantages?

Reason for asking: I'm thinking about it and thought I'd ask because I'm working on a project with someone who is anal about security and something they did was at the top of every script tag, have a jquery statement to remove the script (by ID or otherwise). They also never use .js files

closed as too broad by Sjoerd, Serge Ballesta, Steve, Xander, CaffeineAddiction Apr 27 '17 at 17:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Do you have any specific security benefit in mind? Is there something you have a hunch it could protect against? Or are you just asking in general? – Anders Apr 25 '17 at 9:02
  • How does this question relate to security? It looks like a better fit for stackoverflow to me. (though you should reformulate it to not ask about "pros and cons", some people are allergic to that) – CodesInChaos Apr 25 '17 at 9:13
  • Why do you want to do this? – Philipp Apr 25 '17 at 9:18
  • I believe OP is trying to find a way to hide JavaScript and prevent source code from being stolen. This will fail since you can circumvent it with a simple curl. – Marko Vodopija Apr 25 '17 at 10:01
  • it might also be to prevent other JavaScript from in changing the script in question (or reading its data) by removing the elements from the DOM. Since the question does not specify its unclear what the intended purpose is. – LvB Apr 25 '17 at 10:03
0

I can see no benefits with doing that.

It does not hide your source code. It is still sent to the client, and can easily be read. Besides, the security of your app should not rest on the source code being secret.

I fail to see how it would have any impact on XSS, which is the exploit it seems most related to. XSS is about inserting new scripts, not about using old ones.

But who knows. There might be a corner case out there where this will save you. Just because I can't imagine it, doesn't mean it doesn't exist. But unless you have a clear idea what you are defending against with this, I would not do it. It adds complexity without delivering any clear benefit.

  • To hide variable names is the first thing that comes to mind, but I'm thinking about it and thought I'd ask because I'm working on a project with someone who is anal about security and something they did was at the top of every script tag, have a jquery statement to remove the script (by ID or otherwise). They also never use .js files – Not_Lazy Apr 26 '17 at 17:47
  • 1
    It does not hide variable names at all. Just right click and view source and you got them... So it is utterly useless for obfuscation. And there really shouldn't be a need to hide variable names to stay secure. Never using .js files is not a security benefit. For instance, it prevents you from having a strict CSP. I think the anal security guy needs to explain why the stuff they do provide any security - sounds a bit like security theater to me. – Anders Apr 27 '17 at 10:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.