假设您不希望其他网站将您的网站“框”为<iframe>：
<iframe src="http://example.org"></iframe>
因此，您可以在所有页面中插入反框架，框架破坏JavaScript：
/* break us out of any containing iframes */
if (top != self) { top.location.replace(self.location.href); }
优秀！现在，您可以自动“破坏”或突破包含iframe的任何内容。除了一个小问题。
事实证明，您的框架破坏代码可以被破坏，如下所示：
<script type="text/javascript">
var prevent_bust = 0
window.onbeforeunload = function() { prevent_bust++ }
setInterval(function() {
if (prevent_bust > 0) {
prevent_bust -= 2
window.top.location = 'http://example.org/page-which-responds-with-204'
}
}, 1)
</script>
此代码执行以下操作：
- 每当浏览器尝试通过
window.onbeforeunload事件处理程序导航到当前页面之外时，都会增加一个计数器 - 设置一个计时器，通过触发每毫秒触发一次的计时器，
setInterval()如果看到计数器增加，则将当前位置更改为攻击者控制的服务器 - that server serves up a page with HTTP status code 204, which does not cause the browser to navigate anywhere
My question is -- and this is more of a JavaScript puzzle than an actual problem -- how can you defeat the frame-busting buster?
I had a few thoughts, but nothing worked in my testing:
- attempting to clear the
onbeforeunloadevent viaonbeforeunload = nullhad no effect - adding an
alert()stopped the process let the user know it was happening, but did not interfere with the code in any way; clicking OK lets the busting continue as normal - I can't think of any way to clear the
setInterval()timer
I'm not much of a JavaScript programmer, so here's my challenge to you: hey buster, can you bust the frame-busting buster?
Use htaccess to avoid high-jacking frameset, iframe and any content like images.
This will show a copyright page instead of the expected.