Haketilo

/*

 * Blocking certain attributes that might allow 'javascript:' URLs. Some of

 * these are: <iframe>'s 'src' attributes (would normally execute js in URL upon

 * frame's load), <object>'s 'data' attribute (would also execute upon load) and

 * <a>'s 'href' attribute (would execute upon link click).

 */

    let some_attr_blocked = false;

	/*

	 * Under some browsers (Mozilla) removing attributes doesn't stop their

	 * javascript from executing, but replacing them does. For 'src' and

	 * 'data' I chose to replace the attribute with a 'data:' URL and have

	 * it replace bad <iframe>'s/<object>'s contents with a "blocked"

	 * string. For 'href' (which appears on <a>'s) I chose to use a

	 * 'javascript:' URL to avoid having the page reloaded upon a link

	 * click.

	 */

              "javascript:void('blocked');" : "data:text/plain,blocked";

	some_attr_blocked = true;

			replacement_value);

    }

    /*

     * Trial and error shows that under certain browsers additional element

     * removal and re-addition might be necessary to prevent execution of a

     * 'javascript:' URL (Parabola's Iceweasel 75 requires it for 'src' URL of

     * an <iframe>).

     */

    if (some_attr_blocked) {

	const replacement_elem = document.createElement("a");

	element.replaceWith(replacement_elem);

	replacement_elem.replaceWith(element);

	 * Guard against redefined getter on DOM object property. This is a

	 * supplemental security measure since page's own scripts should be

	 * blocked and unable to redefine properties, anyway.

	 */