Search code examples
javascriptxssuser-tracking

Removing an unwanted part of an external JavaScript


I actually load an external JavaScript on my page this way:

<script type='text/javascript' src='http://somedomain.com/somescript.php'></script>

Note: it is a PHP file, but it produces and gives back a JavaScript code

However, there are two parts of the script - this is the first one, which I need:

document.getElementById('latest').innerHTML= "the lastest version of product";

And here is the second, which is unwanted, and I need to get rid of it:

var img = document.createElement("img");
img.src = "http://somedomain.com/tracking.php";
document.getElementsByTagName("body")[0].appendChild(img);

How can I get rid of this one image, which tracks users, before it will send the data, but leave the showing of the lastest version intact without changes.


Solution

  • Similar to Michael's solution, it should be possible to prevent the javascript from executing by running some code first. If you run the following before adding the script:

    document.getElementsByTagName("body")[0].appendChild = function() {};
    

    Their script will be unable to add the image to the dom. If you need to use that method for yourself, assign it to a different variable first. Or try:

    var oldMethod = document.getElementsByTagName("body")[0].appendChild;
    document.getElementsByTagName("body")[0].appendChild = function(node) {
        if (node.src !== "http://somedomain.com/tracking.php") {
            oldMethod(node);
        }
    }