是否可以在 Javascript 中覆盖 window.location.hostname？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/16462082/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Is it possible to override window.location.hostname in Javascript?
提问by Rob
I'm curious is there any possibility to override window.location.hostname? I didn't found anything about that on google... probably I searched for wrong phrases because I think that someone had to asked it before me.
我很好奇是否有可能覆盖 window.location.hostname？我在谷歌上没有找到任何关于那个的东西......可能我搜索了错误的短语，因为我认为有人不得不在我之前问过它。
Sorry for my bad english.
对不起，我的英语不好。
EDIT: To be more specific. I don't want to do that. I want to know if someone can override that to execute my code.
编辑：更具体地说。我不想那样做。我想知道是否有人可以覆盖它来执行我的代码。
In general - I have list of domains that I approve to execute some code. When
一般来说 - 我有我批准执行一些代码的域列表。什么时候
if (window.location.hostname === myurl.com)gives true then they are good to go, other case they will have alert or something. I don't want someone to do something like that:
if (window.location.hostname === myurl.com)给出 true 那么他们就可以开始了，否则他们会有警觉或什么的。我不希望有人做这样的事情：
window.location.hostname = "myurl.com"
if (window.location.hostname === myurl.com)
采纳答案by Mark Schultheiss
According to this reference: https://developer.mozilla.org/en-US/docs/DOM/window.locationthese are properties. Thus you can "set them to navigate to another URL" - however, that would result in a redirection.
根据此参考：https: //developer.mozilla.org/en-US/docs/DOM/window.location这些是属性。因此，您可以“将它们设置为导航到另一个 URL”——但是，这会导致重定向。
回答by SoonDead
Contrary to what others tell you, it is quite simple:
与其他人告诉您的相反，这很简单：
window.__defineGetter__("location", function(){
return {
hostname: 'malicious site'
};
});
alert(window.location.hostname); // will alert 'malicious site'
window.__defineGetter__("location", function(){
return {
hostname: 'malicious site'
};
});
alert(window.location.hostname); // will alert 'malicious site'
As a thumb rule: every validation you do in JavaScript can be circumvented.
作为一个经验法则：你在 JavaScript 中所做的每一个验证都可以被规避。
EDIT:
编辑：
The above will fail in decent browsers, because of security reasons, but not all browsers consider security an important aspect.
由于安全原因，上述在体面的浏览器中会失败，但并非所有浏览器都将安全视为重要方面。
Execute the following code in old IE (I did this with IE10 compatibility mode, I'm not sure which IE it tries to mimick):
在旧 IE 中执行以下代码（我使用 IE10 兼容模式执行此操作，我不确定它尝试模仿哪个 IE）：
var window = {
location: {
hostname: 'malicious site'
}
};
alert(window.location.hostname);
It will result in malicious site.
它会导致malicious site.
I'm not sure in how many other browsers you can override windowin the given context but it's certainly alarming.
我不确定在window给定的上下文中您可以覆盖多少其他浏览器，但这确实令人担忧。
EDIT2:
编辑2：
You comment to an other answer:
您对另一个答案发表评论：
I want be sure that if someone paste my JS code on site then code didn't execute if he is not on 'the list'.
我想确保如果有人在网站上粘贴我的 JS 代码，那么如果他不在“列表”中，代码就不会执行。
You got this all wrong. Nothing prevents the user that pastes yourcode, from also modifying 'the list'! Or anything else in the JavaScript for that matter!
你这一切都错了。没有什么可以阻止粘贴您的代码的用户也修改“列表”！或者 JavaScript 中的任何其他内容！
Your original code is this for example:
例如，您的原始代码是这样的：
function isInList(hostname) {
for (var i = 0; i < siteList.length; i++) {
if (siteList[i] === hostname) {
return true;
}
}
return false;
}
if (isInList(window.location.hostname)) {
// execute code
} else {
// do not execute
}
The user copying it can modify it to:
复制它的用户可以将其修改为：
function isInList(hostname) {
return true;
}
if (isInList(window.location.hostname)) {
// execute code
} else {
// do not execute
}
Or
或者
if (true) {
// execute code
} else {
// do not execute
}
If the site is his, he has complete control over the javascript executed.
如果该站点是他的，则他可以完全控制所执行的 javascript。
回答by Dek Dekku
It's a property, not a method. I am able to change its value from the Firefox console, and it tries to load the page from a different host (http://fake.host/questions/16462082/...)
它是一种属性，而不是一种方法。我可以从 Firefox 控制台更改它的值，并尝试从不同的主机加载页面（http://fake.host/questions/16462082/...）
回答by andy magoon
Yes, the prototype can be overridden. The reality is that, for your use case, you can't prevent your users from executing Javascript code. Even if they could not override a particular property, they can just execute the code block in their console.
是的，原型可以被覆盖。现实情况是，对于您的用例，您无法阻止用户执行 Javascript 代码。即使他们无法覆盖特定属性，他们也可以在控制台中执行代码块。
回答by klewis
Just store it into a variable and override the variable.
只需将它存储到一个变量中并覆盖该变量。
回答by MarZab
window.location.*are derived from the value of window.location and are read-only
window.location.*派生自 window.location 的值并且是只读的
you can change window.location but that will trigger a redirect
您可以更改 window.location 但这会触发重定向
