monitor searchshield.avgPageMonitor.start(doc); return; } var alltags = doc.getElementsByTagName('*'); for (var i = 0; i < alltags.length; i++) { if (alltags[i].getAttribute('avglschecked')) continue; // ignore linked resources if ((alltags[i].tagName) && (alltags[i].tagName == 'LINK')) continue; // ignore in-page bookmarks and javascript if ((!alltags[i].href) || (alltags[i].href.charAt(0) == '#') || // in-page bookmark (alltags[i].href.indexOf("javascript") == 0)) continue; // ignore verdicts if (alltags[i].id && (alltags[i].id.indexOf("XPLSS_") != -1)) continue; // ignore flyover anchors if (alltags[i].href && (alltags[i].href.indexOf("linkscanner:") == 0 || alltags[i].href.indexOf("avgthreatlabs.com") != -1)) continue; var href = engine.includeLink(alltags[i]); if (!href) continue; var newNode = engine.search.addLink(alltags[i], href); engine.addImage(newNode, engine.search.clockUrl, false); } // recursivesly process all frames var docFrames = doc.frames; if (docFrames && engine.processFrames) { for (var j = 0; j < docFrames.length; j++) { var attr; var frameDoc; try { attr = docFrames[j].frameElement.className; frameDoc = docFrames[j].document; } catch(err){} //TODO: make frame processing an engine function or at least make exclusions an engine property // 'editable' frame it's probably a gmail reply if (attr && (attr.indexOf("editable") != -1)) continue; if (frameDoc) searchshield.avgGetSearchLinks(frameDoc, engine); } } return engine.search.links;};searchshield.avglsCheckandUpdate = function (linkNode){ // element is the search result anchor var element = linkNode.element; var href = linkNode.href; if (!xplSearch) return; var result = searchshield.avgCallFunc(xplSearch.doc, 'CheckSite', href, element.href); if (result == null) return; var resultParse = result.split('::'); var phishing = resultParse[0]; // if phishing then rest of array does not exist. if (phishing == 1) return true; if (resultParse.length < 8) return; var hash = resultParse[1]; var score = resultParse[2]; var new_image = resultParse[3]; var alt_image = resultParse[4]; var flyover = resultParse[5]; var click_thru= resultParse[6]; var altClick_thru = resultParse[7]; // iterate to get verdict anchor nextElem = element.nextSibling; while (nextElem) { if (nextElem.nodeType == 1 && nextElem.id && (nextElem.id.indexOf("XPLSS_") != -1)) break; nextElem = nextElem.nextSibling; } xplSearch.engine.updateImage(hash, xplSearch.searchHash, score, new_image, alt_image, flyover, click_thru, altClick_thru);};// click event handler - shows popup for links of caution and warning severitysearchshield.blockClick = function(event){ if (!event) event = window.event; // no action needed if click is not the left mouse button if (event.button != 0) return; var anchor = searchshield.getAnchorNode(event.srcElement, function(node) {return ((node.tagName.charAt(0) == "H") || (node.tagName.charAt(0) == "D") || (node.tagName.charAt(0) == "T"))} ); if ((anchor == null) || (anchor.href == null)) return true; // ignore if anchor is on an xpl verdict if (!!anchor.id) { if (anchor.id.indexOf('LXPLSS_') == 0) return true; if (anchor.id.indexOf('XPLSS_INTR') == 0) { searchshield.allowedSites.push(searchshield.GetDomain(anchor.href)); return true; } } // VeriSign A/B Split reporting - only for VerSign domains var avglschecked = anchor.getAttribute("avglschecked"); if (avglschecked && avglschecked != 1) { var sPos = avglschecked.indexOf("S"); var hash = (sPos > -1) ? avglschecked.substring(0, sPos) : null; var split = (sPos > -1) ? avglschecked.substring(sPos+1) : null; if (hash && split && split != searchshield.VERISIGN_SPLIT_NOTEST) { // check updated verdict anchor for verisign domain var d = event.srcElement.ownerDocument; if (d.getElementById("LXPLSS_" + hash + "U" + searchshield.SCORE_SS_VERISIGN)) { searchshield.avgCallFunc(d, "RecordVSClick", hash, d.location.href); } } } var link = anchor.href; var verdict = searchshield.getAvgImage(anchor); var score = -1; var img_id = ''; if (verdict != null) { score = verdict.score; img_id = verdict.rawId; } // show popup alert (upper left) if ((score >= searchshield.SCORE_SS_CAUTION) && (score <= searchshield.SCORE_SS_WARNING)) {