I'm using a mobile broadband usb stick and it's inserting a script into my pages. How can I stop it?

StackOverflow https://stackoverflow.com/questions/3799587

  •  05-10-2019
  •  | 
  •  

سؤال

I've recently started using a 3G mobile broadband usb stick. It's from T-Mobile, a UK mobile commmunications company. All seemed well, until I tried to test a site which I've been developing locally on by uploading it to my live server.

When I look at the code of my live site, I can see that 2 things strange are happening:

  1. A script is being inserted into the head of my documents specifically: <script src="http://1.2.3.8/bmi-int-js/bmi.js" language="javascript"></script>

    Is there something I can put in my code to prevent script insertion?

  2. Normally my css is included in my page like:

    <link href="style.css" rel="stylesheet" type="text/css" />

however now when I look in my source, the css has been inserted directly into the page between script tags like:

<style type="text/css" style="display:none">div.calendar{color:#000;font-family:Verdana,Geneva,Arial,Helvetica,sans-serif;-moz-box-shadow:0px.....

This is happening for some javascript files also.

What is going on?

هل كانت مفيدة؟

المحلول

The modifications you're seeing aren't actually present in your site's markup. I've visited your site and can verify this. What's happening is, T-Mobile is trying to "optimize" any site visited using your wireless stick, and doing a bad job of it. This guy's reporting the same problem:

It turns out that T-Mobile (and Vodafone UK) think it is appropriate to insert their own Javascript into each page which I visit, which pipes all images through a proxy to degrade their quality. However, due to an improperly terminated newline, this script cannot be parsed by Firefox or Opera in conjunction with any XHTML 1.1 or XML documents.

Here's the first few lines of your head, as I see it:

<head> 
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> 
<title>The Smile Zone | Home</title> 
<link rel="stylesheet" type="text/css" href="manager/templates/smiletemplate/css/style.css" /> 
<link type="text/css" rel="stylesheet" href="http://www.jotform.com/css/styles/form.css?v3"/> 
<link href="manager/templates/smiletemplate/css/calendarview.css" rel="stylesheet" type="text/css" />

I don't know if you can override this behavior of your wireless service, but you can rest assured that other visitors to your site aren't having the same issues.

نصائح أخرى

In T-mobile it's called "Mobile Broadband Accelerator" You can Visit: http://accelerator.t-mobile.co.uk or http://1.2.3.50/ to disable/configure it. Also please have a look at Stop mobile network proxy from injecting JavaScript

If you load the website using SSL or browse using a VPN (or Tor) then your ISP won't be able to see the data to modify it. This doesn't necessarily help your users, though.

Is there something I can put in my code to prevent script insertion?

If you set the Content-Security-Policy HTTP header for your website, you'll be able to stop the injected script from being able to load in modern browsers.

See "html5rocks: An Introduction to Content Security Policy" to get started. However, with such a policy you'll have to be careful not to deny resources that your own website requires, e.g. Google fonts, CDNs, etc. and that can be time-consuming to get right.

Example, the following HTTP header will only allow modern browsers to fetch resources from your website's own domain, thus preventing the external BMI script from being fetched:

Content-Security-Policy: default-src 'self';
مرخصة بموجب: CC-BY-SA مع الإسناد
لا تنتمي إلى StackOverflow
scroll top