Post Reply 
Update: Jump out of invisible Frames
Feb. 20, 2009, 07:28 PM
Post: #1
Update: Jump out of invisible Frames
Modified to also account for unclosed <noframes> tags.

Code:
[Patterns]
Name = "<frameset>: Jump out of invisible Frames     9.02.20 [sd] (d.2 l.3)"
Active = TRUE
URL = "$TYPE(htm)(^$TST(keyword=*.(a_invframe|i_level:[12]).*))"
Bounds = "$NEST(<frameset,<(/frameset |noframes[^>]+)>)"
Limit = 3072
Match = "(^$TST(script=*)|$TST(comment=1))$STOP()"
        "*<frameset([^>]++\s(cols$SET(5=rows)|rows$SET(5=cols))=("
        ""
        "$AV( (\*\*+|99%|100%)( , (\*\*+|[#0:1](.[#0:*]|)%|[#0:22])|) )"
        "(*<frame)+{1}\s[^>]++src=("
        "$AV( ([^/.]+//)\4(^$TST(uHost)(^.))(\3\s(^?)|\3))*"
        "|$AV( \3\s(^?)| \3)(*<frame)+{1}\s[^>]++src=$AV( [^/.]+//(^$TST(uHost)(^.))*)*"
        ")|"
        "$AV( ((\*\*+|[#0:1](.[#0:*]|)%|[#0:22]) , |)(\*\*+|99%|100%) )"
        "(*<frame)+{2}\s[^>]++src=$AV( ([^/.]+//)\4(^$TST(uHost)(^.))(\3\s(^?)|\3))*"
        "|"
        "$AV( [#0:1](.[#0:*]|)(%|) , [#0:1](.[#0:*]|)(%|) , (\*\*+|99%|100%) )"
        "(*<frame)+{3}\s[^>]++src=$AV( ([^/.]+//)\4(^([^/]++.|)$TST(uDom)(^.))(\3\s(^?)|\3))*"
        ""
        ")&(^[^>]++\s$TST((\5))=$AV(*,*)))"
        ""
        "|<[^<]+<frame\s[^>]++src="
        "$AV( ([^/.]+//)\4(^$TST(uHost)(^.))(\3\s(^?)|\3)|(*redirect&(\3\s(^?)|\3)))(^*<frame)*"
        ""
        "&($TST(\4=https://)$TST(keyword=*.i_ssl_h:[12].*)$SET(2=http://https-px-.)|$SET(2=\4))"
        "&$SET(a=\2\3)$TST(a=(\#[\r\n])+\#)$SET(a=\@)((^$TST(a=\u))|$SET(a=)PrxFail$TST())"
        "&$SET(0=$TST(tNoscript=1)</noscript>\r\n)"
        "($TST(hOrigUA=*(msie|opera|mozilla/4.[1-9])*)$SET(1=assign)|$SET(1=replace))"
        "($TST(volat=*.log:2*)$ADDLST(Log-Main,[$DTM(d T)]\tWEB Frame_Inv\t\@ \t\u)|)"
Replace = "\0<script type="text/javascript">document.location.\1("\@");</script>\r\n"
          "</html>$SET(a=)\k"
Add Thank You Quote this message in a reply
Post Reply 


Forum Jump: