Mimsy Were the Borogoves

Mimsy Were the Technocrats: As long as we keep talking about it, it’s technology.

Safari 8.0.7 can block endless alerts

Jerry Stratton, July 12, 2015

I just ran some software updates last week, and reading the latest Software Update notes, I noticed:

Fixes an issue where a website could prevent the user from navigating away by presenting repeated JavaScript alerts in Safari.

After doing the update, I went to the parent page and hit the deadly link. Sure enough, on the second iteration Safari added a checkbox to the alert:

Don’t show more alerts from this webpage

Checking that box makes the alerts go away.

Testing what it’s doing under the hood is difficult, as checking that box also seems to block reloading the page. I’m not sure that’s a bad thing.

It appears to disable any JavaScript on the page. I can’t even go to the URL bar and get an alert from:

  • javascript:alert("Hello");

Again, I think that’s a good thing. If the page has potentially malicious JavaScript, block it all.

JavaScript that doesn’t involve alerts also fails from the URL bar:

  • javascript:headlines=document.getElementsByTagName("h1");headline=headlines[0];headline.innerHTML="Hello, World";

So it looks like “Don’t show more alerts” means “stop executing scripts on this page”. The Error Console doesn’t show any errors; the script simply doesn’t execute.

In response to Why are JavaScript alerts still capable of blocking browser activity?: JavaScript alerts should not be allowed to block the browser.

  1. Safari freed ->