Question

The following is a theoretical question, that I hope someone will be able to provide with an answer.

I’ve explored a bit and found that the following is very (dangerously) possible:

$('#link').click(function() {
    window.location = 'http://www.malicious-example.com';
    return false;
});

As seen in this live example.

---

Now I may not be very sharp at JavaScript, but this seems like a gigantic security hole, I mean, the browser thinks and shows (in the bottom) that the link is indeed going to http://google.com, when it will eventually lead to http://www.malicious-example.com.

Does anyone have any information of this issue? Are there measures taken to take care of it?

Answer 1

There is not much that can be done about it and to be honest I hardly see the concern. Barely visiting a webpage can rarely be harmful and if a site was to do that, why not simply redirect the user as soon as the page loads?

There used to be some issues with JavaScript, mainly related to alerts and the ability to cancel a page change, but most proper browsers have dealth with them in various ways. For example, if two alerts are made very quickly you will have the option of turning off all further alerts, and browsers now detect if the page is attempting to stop the user from leaving and will output their own message.