0

I'm experimenting with instantiating an inline Web Worker using a Blob by passing in a code string that I can first check, and amend (as described here).

If the code string is unknown, can I disallow it from using (say) XmlHttpRequest?

For instance, would prepending

XmlHttpRequest = null;

at the top of the script string prevent the code following it from finding a way to instantiate XmlHttpRequest (with e.g. var xhr = new self['Xml'+'HttpRequest'])? Or is trying that a lost cause? Thanks!

Community
  • 1
  • 1
Philipp Lenssen
  • 8,818
  • 13
  • 56
  • 77

1 Answers1

1

Let's try it

https://i.stack.imgur.com/I2g4Z.png

Yes, it prevents further code from using XMLHttpRequest.

A few notes:

  • There is another constructor called XMLHttpRequestUpload, just do the same for that one as well.
  • I tested this in Firefox, try it in some other browsers as well if you want to be absolutely sure.

(F12 to open developer console, you can just type JavaScript directly into that)

TRGWII
  • 648
  • 5
  • 14
  • Thanks, that I've indeed tried -- I was wondering though if there's any imaginable way to e.g. "get back" that XMLHttpRequest through some route? Guess not? – Philipp Lenssen Feb 12 '15 at 20:23
  • window.XMLHttpRequest is the only reference to that particular constructor, and if that is removed, the function can in no way be referenced again. – TRGWII Feb 12 '15 at 20:29