Secure Browser Runtime

This (blazing fast, 727B gzipped) library aims to provide a simple way to prevent the rewriting or overriding of several fundamental browser APIs that you need to work with on a daily basis, saving you from suffering unpleasant headaches while trying to debug something you didn't write, and happens to be done by an external source.

Installing

Using npm:

npm install secure-browser-runtime

Using yarn:

yarn add secure-browser-runtime

Using CDN:

<script src="https://unpkg.com/secure-browser-runtime/dist/main.js"></script>

Supported browsers

IE / Edge	Firefox	Chrome	Safari	iOS Safari	Opera
IE10, IE11, Edge	last 2 versions	last 2 versions	last 2 versions	last 2 versions	last 2 versions

Usage

You can load the code through the import spec, it will be automatically executed.

import 'secure-browser-runtime';

Also, you can still use the require function:

require('secure-browser-runtime');

Important note: This must be placed at the very beginning of your application (e.g. main entrypoint for ES5+, first script in the DOM for pure HTML):

What happens when I load this in the browser?

With Great Power Comes Great Responsibility.

Have you ever stumbled upon code like this?

window.addEventListener('load', function(e) {
  console.log('Document is ready!');
  // Do some magic...
});

Everything seems to be ok, huh?

Well, it actually may be a possibility that the above code will not behave as expected.

Imagine some third-party JS script included in your page that contains something like this:

window.addEventListener = function(eventName, callback, ...others) {
  // Do something very evil
}

At this point, everything would depend on how the third-party script developed the new function which is assigned to that property.

To prevent this, we just wrap the properties we don't want to be overwritten, by using the Object.defineProperty method like this:

// We initially store the original reference into a constant
const propertyReference = window.addEventListener;
// Then we delete the reference to the previous value from the real object
delete window.addEventListener;
// So that we can redefine it, setting the `writeable` option to false
Object.defineProperty(window, 'addEventListener', {
  value: propertyReference,
  writeable: false,
});

Once this code is executed, every other attempt to overwrite that method will not work and the initial value will be kept instead.

Tip: this will likely help you too (just in case you're thinking to do stuff like this and break other people's functionalities) by throwing an error when trying to set values through the = operator or the Object.defineProperty() method, and also when trying to use the delete keyword in Strict Mode.

---

Here's the full list of properties that will be enclosed in a non-writable version of their initial value:

Parent object	Property name	Parent object	Property name
window	addEventListener	document	addEventListener
window	alert	document	adoptNode
window	atob	document	close
window	blur	document	createAttribute
window	btoa	document	createComment
window	clearInterval	document	createDocumentFragment
window	clearTimeout	document	createElement
window	close	document	createEvent
window	confirm	document	createTextNode
window	focus	document	execCommand
window	getComputedStyle	document	getElementById
window	getSelection	document	getElementsByClassName
window	matchMedia	document	getElementsByName
window	moveBy	document	getElementsByTagName
window	moveTo	document	hasFocus
window	open	document	importNode
window	print	document	normalize
window	prompt	document	normalizeDocument
window	removeEventListener	document	open
window	resizeBy	document	querySelector
window	resizeTo	document	querySelectorAll
window	scroll	document	removeEventListener
window	scrollBy	document	renameNode
window	scrollTo	document	write
window	setInterval	document	writeln
window	setTimeout
window	stop

Contributing

Feel free to contribute adding elements to the list, if you think they should be protected, or maybe improve the structure and efficiency of the algorithm! Why not? Everything is welcome in the Open Source world :)