Skip to content

Instantly share code, notes, and snippets.

@ckalegi
Created October 19, 2018 14:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ckalegi/f93c827fcb49de880696ebf9dc0b5542 to your computer and use it in GitHub Desktop.
Save ckalegi/f93c827fcb49de880696ebf9dc0b5542 to your computer and use it in GitHub Desktop.
Prevent obfuscated client side scripts from calling anonymous debugger functions
window.unsafeWindow || (
unsafeWindow = (function () {
var el = document.createElement('p');
el.setAttribute('onclick', 'return window;');
return el.onclick();
}())
);
(function () {
var _constructor = unsafeWindow.Function.prototype.constructor;
unsafeWindow.Function.prototype.constructor = function () {
var fnContent = arguments[0];
if (fnContent) {
// Check if function is trying to stop debugger
if (fnContent.includes('debugger')) {
var caller = Function.prototype.constructor.caller; // Non-standard hack to get the function caller
var callerContent = caller.toString();
if (callerContent.includes(/\bdebugger\b/gi)) { // Eliminate all debugger statements from the caller, if any
callerContent = callerContent.replace(/\bdebugger\b/gi, ''); // Remove all debugger expressions
eval('caller = ' + callerContent); // Replace the function
}
return (function () {});
}
}
// Execute the normal function constructor if nothing unusual is going on
return _constructor.apply(this, arguments);
};
})();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment