阻止移动网络代理注入 JavaScript
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4113268/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Stop mobile network proxy from injecting JavaScript
提问by Masud Rahman
I am using a mobile network based internet connection and the source code is being rewritten when they present the site to the end user.
我正在使用基于移动网络的互联网连接，当他们向最终用户展示网站时，正在重写源代码。
In the localhost my website looks fine, but when I browse the site from the remote server via the mobile network connection the site looks bad.
在本地主机中，我的网站看起来不错，但是当我通过移动网络连接从远程服务器浏览该网站时，该网站看起来很糟糕。
Checking the source code I found a piece of JavaScript code is being injected to my pages which is disabling the some CSS that makes site look bad.
检查源代码，我发现一段 JavaScript 代码被注入到我的页面，这会禁用一些使网站看起来很糟糕的 CSS。
I don't want image compression or bandwidth compression instead of my well-designed CSS.
我不想要图像压缩或带宽压缩，而不是我精心设计的 CSS。
How can I prevent or stop the mobile network provider (Vodafone in this case) from proxy injecting their JavaScript into my source code?
如何防止或阻止移动网络提供商（本例中为 Vodafone）代理将其 JavaScript 注入我的源代码？
回答by Piotr Kula
You can use this on your pages. It still compresses and put everything inline but it wont break scripts like jquery because it will escape everything based on W3C Standards
你可以在你的页面上使用它。它仍然压缩并将所有内容内联，但它不会破坏像 jquery 这样的脚本，因为它会基于 W3C 标准转义所有内容
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
On your server you can set the cahce control
在您的服务器上，您可以设置 cahce 控制
"Cache-Control: no-transform"
This will stop ALLmodifications and present your site as it is!
这将停止所有修改并按原样显示您的网站！
Reference docs here
参考文档在这里
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.5
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.5
http://stuartroebuck.blogspot.com/2010/08/official-way-to-bypassing-data.html
http://stuartroebuck.blogspot.com/2010/08/official-way-to-bypassing-data.html
Web site exhibits JavaScript error on iPad / iPhone under 3G but not under WiFi
回答by bobince
You're certainly not the first. Unfortunately many wireless ISPs have been using this crass and unwelcome approach to compression. It comes from Bytemobile.
你肯定不是第一个。不幸的是，许多无线 ISP 一直在使用这种粗鲁且不受欢迎的压缩方法。它来自Bytemobile。
What it does is to have a proxy recompress all images you fetch smaller by default (making image quality significantly worse). Then it crudely injects a script into your document that adds an option to load the proper image for each recompressed image. Unfortunately, since the script is a horribly-written 1990s-style JS, it craps all over your namespace, hiHymans your event handlers and stands a high chance of messing up your own scripts.
它的作用是让代理重新压缩默认情况下您获取的所有图像（使图像质量明显变差）。然后它粗略地将一个脚本注入到您的文档中，该脚本添加了一个选项来为每个重新压缩的图像加载正确的图像。不幸的是，由于该脚本是一个写得很糟糕的 1990 年代风格的 JS，它会在您的命名空间中乱扔垃圾，劫持您的事件处理程序，并且很有可能弄乱您自己的脚本。
I don't know of a way to stop the injection itself, short of using HTTPS. But what you could do is detect or sabotage the script. For example, if you add a script near the end of the document (between the 1.2.3.4 script inclusion and the inline script trigger) to neuter the onload hook it uses:
除了使用 HTTPS，我不知道有什么方法可以停止注入本身。但是您可以做的是检测或破坏脚本。例如，如果您在文档末尾附近（在 1.2.3.4 脚本包含和内联脚本触发器之间）添加一个脚本来中和它使用的 onload 钩子：
<script type="text/javascript">
bmi_SafeAddOnload= function() {};
</script>
then the script wouldn't run, so your events and DOM would be left alone. On the other hand the initial script would still have littered your namespace with junk, and any markup problems it causes will still be there. Also, the user will be stuck with the recompressed images, unable to get the originals.
那么脚本将不会运行，因此您的事件和 DOM 将被搁置。另一方面，初始脚本仍然会在您的命名空间中散布垃圾，并且它导致的任何标记问题仍然存在。此外，用户将被重新压缩的图像卡住，无法获得原始图像。
You could try just letting the user know:
您可以尝试让用户知道：
<script type="text/javascript">
if ('bmi_SafeAddOnload' in window) {
var el= document.createElement('div');
el.style.border= 'dashed red 2px';
el.appendChild(document.createTextNode(
'Warning. Your wireless ISP is using an image recompression system '+
'that will make pictures look worse and which may stop this site '+
'from working. There may be a way for you to disable this feature. '+
'Please see your internet provider account settings, or try '+
'using the HTTPS version of this site.'
));
document.body.insertBefore(el, document.body.firstChild);
}
</script>
回答by Cam Hymanson
I'm suprised no one has put this as answer yet. The real solution is:
我很惊讶还没有人把这个作为答案。真正的解决办法是：
USE HTTPS!
使用HTTPS！
This is the only way to stop ISPs (or anyone else) from inspecting all your traffic, snooping on your visitors, and modifying your website in flight.
这是阻止 ISP（或其他任何人）检查您的所有流量、窥探您的访问者和修改您的网站的唯一方法。
With the advent of Let's Encrypt, getting a certificate is now free and easy. There's really no reason not to use HTTPS in this day and age.
随着Let's Encrypt的出现，现在可以免费轻松地获得证书。在这个时代，真的没有理由不使用 HTTPS。
You should also use a combination of redirects and HSTSto keep all of your users on HTTPS.
您还应该结合使用重定向和HSTS来让所有用户都使用 HTTPS。
回答by Alexander Janssen
You provider might have enabled a Bytemobile Unison feature called "clientless personalization". Try accessing the fixed URL http://1.2.3.50/ups/- if it's configured, you will end up on a page which will offer you to disable all feature you don't like. Including Javascript injection.
您的提供商可能启用了称为“无客户端个性化”的 Bytemobile Unison 功能。尝试访问固定 URL http://1.2.3.50/ups/- 如果它已配置，您将最终进入一个页面，该页面将提供您禁用所有您不喜欢的功能。包括 Javascript 注入。
Good luck! Alex.
祝你好运！亚历克斯。
回答by Russell Harkins
If you're writing you own websites, adding a header worked for me:
如果您正在编写自己的网站，添加标题对我有用：
PHP:
Header("Cache-Control: no-transform");
C#:
Response.Cache.SetNoTransforms();
VB.Net:
Response.Cache.SetNoTransforms()
Be sure to use it before any data has been sent to the browser.
请务必在任何数据发送到浏览器之前使用它。
回答by mgutt
I found a trick. Just add:
我发现了一个技巧。只需添加：
<!--<![-->
After:
后：
<html>
More information (in German):
更多信息（德语）：
回答by pawciobiel
BMI js it's not only on Vodafone. Verginmedia UK and T-Mobile UK also gives you this extra feature enabled as default and for free. ;-) In T-mobile it's called "Mobile Broadband Accelerator" You can Visit: http://accelerator.t-mobile.co.ukor http://1.2.3.50/to configure it.
BMI js 它不仅在沃达丰上。Verginmedia UK 和 T-Mobile UK 还为您提供这项默认启用且免费的额外功能。;-) 在 T-mobile 中，它被称为“移动宽带加速器”。您可以访问：http: //accelerator.t-mobile.co.uk或 http://1.2.3.50/进行配置。
In case the above doesn't apply to you or for some reason it's not an option you could potentially set-up your local proxy (Polipo w/wo Tor) There is also a Firefox addon called "blocksite" or as more drastic approach reset tcp connection to 1.2.3.0/24:80 on your firewall. But unfortunately that wouldn't fix the damage.
如果上述内容不适用于您或由于某种原因它不是一个选项，您可能会设置您的本地代理（Polipo w/wo Tor） 还有一个名为“blocksite”的 Firefox 插件，或者更激进的方法重置tcp 连接到防火墙上的 1.2.3.0/24:80。但不幸的是，这并不能修复损坏。
Funny enough T-mobile and Verginmedia mobile/broadband support is not aware about this feature! (2011.10.11)
有趣的是，T-mobile 和 Verginmedia 移动/宽带支持不知道此功能！(2011.10.11)
回答by Bob
PHP: Header("Cache-Control: no-transform"); Thanks! I'm glad I found this page.
PHP: Header("Cache-Control: no-transform"); 谢谢！我很高兴我找到了这个页面。
That Injector script was messing up my php page source code making me think I made an error in my php coding when viewing the page source. Even though the script was blocked with firefox NoScript add on. It was still messing up my code. Well, after that irritating dilemma, I wanted to get rid of it completely and not just block it with adblock or noscript firefox add ons or just on my php page.
那个注入器脚本弄乱了我的 php 页面源代码，让我认为我在查看页面源代码时在 php 编码中犯了错误。即使脚本被 Firefox NoScript 添加阻止。它仍然弄乱了我的代码。好吧，在那个令人恼火的困境之后，我想彻底摆脱它，而不仅仅是使用 adblock 或 noscript firefox 附加组件或仅在我的 php 页面上阻止它。
- STOP http:// 1.2.3.4 Completely in Firefox: Get the add on: Modify Headers.
- Go to the modify header add on options... now on the Header Tab.
- Select Action: Choose ADD.
- For Header Name type in: cache-control
- For Header Value type in: no-transform
- For Comment type in: Block 1.2.3.4
- Click add... Then click Start.
- 停止 http:// 1.2.3.4 完全在Firefox 中：获取附加组件：修改标题。
- 转到修改标题添加选项...现在在标题选项卡上。
- 选择操作：选择添加。
- 对于标题名称类型：cache-control
- 对于 Header Value 输入：no-transform
- 对于评论类型：Block 1.2.3.4
- 单击添加...然后单击开始。
The 1.2.3.4 script will not be injected into any more pages! yeah!
1.2.3.4 脚本将不再注入任何页面！是的！
I no longer see 1.2.3.4 being blocked by NoScript. cause it's not there. yeah.
我不再看到 1.2.3.4 被 NoScript 阻止了。因为它不在那里。是的。
But I will still add: PHP: Header("Cache-Control: no-transform"); to my php pages.
但我还是要补充一下： PHP: Header("Cache-Control: no-transform"); 到我的 php 页面。
回答by Falkenj80
Ok nothing working to me. Then i replace image url every second because when my DOM updates, the problem is here again. Other solution is only use background style auto include in pages. Nothing is clean.
好吧，对我没有任何作用。然后我每秒更换图像 url，因为当我的 DOM 更新时，问题又来了。其他解决方案是仅使用背景样式自动包含在页面中。没有什么是干净的。
setInterval(function(){ imageUpdate(); }, 1000);
function imageUpdate() {
console.log('######imageUpdate');
var image = document.querySelectorAll("img");
for (var num = 0; num < image.length; num++) {
if (stringBeginWith(image[num].src, "http://1.1.1.1/bmi/***yourfoldershere***")) {
var str=image[num].src;
var res=str.replace("http://1.1.1.1/bmi/***yourfoldershere***", "");
image[num].src = res;
console.log("replace"+str+" by "+res);
/*
other solution is to push img src in data-src and push after dom loading all your data-src in your img src
var data-str=image[num].data-src;
image[num].src = data-str;
*/
}
}
}
function stringEndsWith(string, suffix) {
return string.indexOf(suffix, string.length - suffix.length) !== -1
}
function stringBeginWith(string, prefix) {
return string.indexOf(prefix, prefix.length-string.length) !== -1
}
回答by jaredwilli
If you are getting it on a site that you own or are developing, then you can simply override the function by setting it to null. This is what worked for me just fine.
如果您是在您拥有或正在开发的站点上获取它，那么您可以通过将其设置为 null 来简单地覆盖该功能。这对我来说很好用。
bmi_SafeAddOnload = null;
As for getting it on other sites you visit, then you could probably open the devtools console and just enter that into there and wipe it out if a page is taking a long time to load. Haven't yet tested that though.
至于在您访问的其他站点上获取它，那么您可能可以打开 devtools 控制台，然后将其输入到那里，如果页面加载时间很长，则将其清除。不过还没有测试过。
