Re: Pop ups

Hi Alice

> Could anyone confirm whether html of a web page will indicate if the 
> page contains pop-ups?

A few thoughts based on this question and on responses so far:

1) I can't think about an instance (I'm sure someone else will correct 
me) where pure HTML will cause a new window to open without user 
intervention.  The HTML "target" attribute of the anchor tag can be used 
to specify if the link is to be opened "here" or somewhere else, the 
link being called by the user selecting it.

Target could be used, for instance, in a menu in a frameset (call it 
page 'foo'); by setting the target to point to another member of the 
frameset (page 'bar'), the menu (foo) stays constant and the pages 
pointed to by the links appear in bar.

If, however, we call a target of, say, _new, then we get a new window - 
or tab if we're using Firefox and have configured it accordingly...

2) JavaScript embedded in an HTML document (as opposed to HTML itself) 
seems to be the main culprit for windows that open themselves without 
being requested.  As David points out, the presence of window.open in a 
document neither says that a window will or won't be opened:
* window.open may be commented out in the code;
* window.open may be in a subroutine that is not called;
* window.open may be called by a logical 'if' that never returns true;
* window.open may be called indirectly from a subroutine in an external 
JavaScript file - in the HTML source we may only see a call to 
subroutine baz() which is external and not visible in the source of this 
document.

If one was really sneaky, one could build a window.open command out of 
unrecognisable fragments of code, then run it using eval().  (If I 
remember my JS correctly.)

3) Flash can open new windows too; I can't comment on it further as I've 
never tried to examine Flash source and run a Flash blocking tool on my 
browser.

4) Anyone know if a Java applet can open windows from the parent document?

So - trying to find if a popup is going to occur is possible, just very, 
very, tricky.  To do so would involve working ones way not only through 
the HTML of a document, but also through any scripts and/or objects that 
are either embedded in the HTML or are called from an external file.

This would be time-consuming for a human and next to impossible to 
automate.  To create a tool, however, that could prioritise documents 
for human analysis would be fairly simple; the document would need to be 
checked for the <script>, <object> and <embed> elements and also check 
any anchor elements for the presence of a target= attribute.

We could improve on this a little to reduce "false positives":

A "spider" programme could be written that could look at a document (or 
collection of documents) and go a step further:
* Is this document in a frameset?  I yes, find the names of all the 
frames; if any document in a frameset contains a target attribute not in 
that list of names, we've probably got a popup.
* Does the pattern /window.open/ occur anywhere in this document or in 
any script sources referenced by it?
* Does the document reference any files with MIME types that would 
suggest the use of Flash or any other type of object that has the 
ability to cause a new window to be opened?  I don't know if it's 
possible to download and reverse-engineer a .swf file to check it for 
possible window opening commands.  I just downloaded one to look, but it 
appeared to be a binary file so I wouldn't know where to go from there.

As I don't have any particular use for such a tool myself, I'm not about 
to sit down and write one, but it could be an interesting project for 
someone.

I don't really know if I've answered your question, but it's a little 
food for thought, anyway.

Cheers

M

-- 
Matthew Smith
Kadina Business Consultancy
South Australia
http://www.kbc.net.au

Received on Wednesday, 30 March 2005 23:58:30 UTC