{ var isPhishing = searchshield.avglsCheckandUpdate(links[i]); if (isPhishing) searchshield.needLivePhishCheck = true; } if (searchshield.needLivePhishCheck) { var prev = '1'; if ( xplSearch.engine.type == 'inline' ) prev = '0'; searchshield.avgCallFunc(doc, 'GetPhishingResults', prev); searchshield.needLivePhishCheck = false; } else if (links.length > 0 && xplSearch.engine.type != 'inline') { searchshield.avgCallFunc(doc, 'FinalScanComplete'); } // attach click handlers for popup alerts doc.body.detachEvent("onclick", searchshield.blockClick); doc.body.attachEvent("onclick", searchshield.blockClick); doc.body.detachEvent("ondblclick", searchshield.blockClick); doc.body.attachEvent("ondblclick", searchshield.blockClick);};searchshield.avgGetSearchLinks = function (doc, engine, refresh){ if (!doc.body) return; var alltags = doc.body.getElementsByTagName('a'); for (var i = 0; i < alltags.length; i++) { if ( !refresh ) { // no checked test if refreshing - google if (alltags[i].getAttribute('avglschecked')) continue; } // mark search result anchor so it isn't processed repeatedly alltags[i].setAttribute('avglschecked', '1'); // ignore linked resources if (alltags[i].tagName == 'LINK') continue; // ignore in-page bookmarks and javascript if ((!alltags[i].href) || (alltags[i].href.charAt(0) == '#') || // in-page bookmark (alltags[i].href.indexOf("javascript") == 0)) continue; // ignore verdicts if (/XPLSS_/.test(alltags[i].id)) continue; // ignore flyover anchors if (/avgthreatlabs/.test(alltags[i].host)) continue; var href = engine.includeLink(alltags[i]); if (!href) continue; var newNode = engine.search.addLink(alltags[i], href); engine.addImage(newNode, engine.search.clockUrl, false); } // recursivesly process all frames var docFrames = doc.frames; if (docFrames && engine.processFrames) { for (var j = 0; j < docFrames.length; j++) { var attr; var frameDoc; try { attr = docFrames[j].frameElement.className; frameDoc = docFrames[j].document; } catch(err){} //TODO: make frame processing an engine function or at least make exclusions an engine property // 'editable' frame it's probably a gmail reply if (attr && (attr.indexOf("editable") != -1)) continue; if (frameDoc) searchshield.avgGetSearchLinks(frameDoc, engine, 0); } } return engine.search.links;};searchshield.avglsCheckandUpdate = function (linkNode){ if (!xplSearch) return; // element is the search result anchor var element = linkNode.element; var href = linkNode.href; var result = searchshield.avgCallFunc(xplSearch.doc, 'CheckSite', href, element.href); if (result == null) return; var resultParse = result.split('::'); var phishing = resultParse[0]; // if phishing then rest of array does not exist. if (phishing == 1) return true; if (resultParse.length < 8) return; var hash = resultParse[1]; var score = resultParse[2]; var new_image = resultParse[3]; var alt_image = resultParse[4]; var flyover = resultParse[5]; var click_thru= resultParse[6]; var altClick_thru = resultParse[7]; // iterate to get verdict anchor nextElem = element.nextSibling; while (nextElem) { if (nextElem.nodeType == 1 && nextElem.id && (nextElem.id.indexOf("XPLSS_") != -1)) break; nextElem = nextElem.nextSibling; } return xplSearch.engine.updateImage(hash, xplSearch.searchHash, score, new_image, alt_image, flyover, click_thru, altClick_thru);};// click event handler - shows popup for links of caution and warning severitysearchshield.blockClick = function(event){ if (!event) event = window.event; // no action needed if click is not the left mouse button if (event.button != 0) return; var anchor = searchshield.getAnchorNode(event.srcElement, function(node) {return ((node.tagName.charAt(0) == "H") || (node.tagName.charAt(0) == "D") || (node.tagName.charAt(0) == "T"))} ); if ((anchor == null) || (anchor.href == null)) return true; // ignore if anchor is on an xpl verdict if (!!anchor.id) { if (anchor.id.indexOf('LXPLSS_') == 0) return true; if (anchor.id.indexOf('XPLSS_INTR') == 0) { searchshield.allowedSites.push(searchshield.GetDomain(anchor.href)); return true; } } // VeriSign A/B Split reporting - only for VerSign domains var avglschecked = anchor.getAttribute("avglschecked"); if (avglschecked && avglschecked != 1) { var sPos = avglschecked.indexOf("S"); var hash = (sPos > -1) ? avglschecked.substring(0, sPos) : null; var split = (sPos > -1) ? avglschecked.substring(sPos+1) : null;