Search code examples
javascriptdomsandbox

Freezing the DOM to JavaScript: Overwriting DOM modification functions as no-ops


I'm writing a piece of code that requires the DOM of a website to remain frozen while arbitrary JavaScript runs. Attributes changing is fine but I can't have anything changing the original tag structure of the page!

I know in JavaScript there are a base number of functions that can modify the DOM:

appendChild( nodeToAppend )
cloneNode( true|false )
createElement( tagName )
createElemeentNS( namespace, tagName )
createTextNode( textString )
innerHTML
insertBefore( nodeToInsert, nodeToInsertBefore )
removeChild( nodetoRemove )
replacechild( nodeToInsert, nodeToReplace )

My initial thought was simply to overwrite these functions as no ops:

>>> document.write('<p>Changing your DOM. Mwwhaha!</p>')
>>> document.write = function() {}
>>> document.write('<p>No-op now!</p>')

While it's easy to do this for the document object the DOM modification functions can be called from many different JavaScript objects! If I could overwrite these functions at top level perhaps it would work?

Update from sktrdie:

>>> HTMLElement.prototype.appendChild = function(){}
>>> $("a").get(0).appendChild(document.createElement("div"))
# Still works argh.
>>> HTMLAnchorElement.prototype.appendChild = function(){}
>>> $("a").get(0).appendChild(document.createElement("div"))
# No-op yeah!

So it would seem I could just gather the constructors of all DOM elements and run over them putting in no-ops but that still seems pretty messy ...

How can I protect the DOM from modification from arbitrary JavaScript?


Solution

  • Have you tried HTMLElement.prototype.appendChild = function(){} to overwrite DOM methods at a higher level?