search monitors and processors - doc is always top most documentsearchshield.avgPageMonitor = { previousUrl: null, start: function(doc){ searchshield.avgPageMonitor.stop(); searchshield.avgPageMonitor.process(doc); searchshield.avgPageMonitor.timeoutID = window.setTimeout(function(){searchshield.avgPageMonitor.start(doc)}, 1000); }, process: function(doc){ var currentUrl = doc.location.href; var refresh = 0; if (this.previousUrl != currentUrl) { this.previousUrl = currentUrl; avgreport.scanResult(doc, currentUrl); refresh = (xplSearch.engine.name == 'google') ? 1 : 0; } searchshield.avgProcessSearch(doc, refresh); }, stop: function(){ if (searchshield.avgPageMonitor.timeoutID) { window.clearTimeout(searchshield.avgPageMonitor.timeoutID); delete searchshield.avgPageMonitor.timeoutID; } }};searchshield.avgProcessSearch = function (doc, refresh){ // doc may be about:Tabs or about:Blank if (!doc) return; if (!searchshield.enabled(doc)) return; if (!searchshield.clockUrl) searchshield.clockUrl = searchshield.avgCallFunc(doc, 'GetIconUrl', '0'); xplSearch.clockUrl = searchshield.clockUrl if (!xplSearch.engine) return; // get result links xplSearch.links = []; var links = searchshield.avgGetSearchLinks(doc, xplSearch.engine, refresh); searchshield.needLivePhishCheck = false; for (var i=0; i < links.length; i++) { var isPhishing = searchshield.avglsCheckandUpdate(links[i]); if (isPhishing) searchshield.needLivePhishCheck = true; } if (searchshield.needLivePhishCheck) { var prev = '1'; if ( xplSearch.engine.type == 'inline' ) prev = '0'; searchshield.avgCallFunc(doc, 'GetPhishingResults', prev); searchshield.needLivePhishCheck = false; } else if (links.length > 0 && xplSearch.engine.type != 'inline') { searchshield.avgCallFunc(doc, 'FinalScanComplete'); } // attach click handlers for popup alerts doc.body.detachEvent("onclick", searchshield.blockClick); doc.body.attachEvent("onclick", searchshield.blockClick); doc.body.detachEvent("ondblclick", searchshield.blockClick); doc.body.attachEvent("ondblclick", searchshield.blockClick);};searchshield.avgGetSearchLinks = function (doc, engine, refresh){ if (!doc.body) return; var alltags = doc.body.getElementsByTagName('a'); for (var i = 0; i < alltags.length; i++) { if ( !refresh ) { // no checked test if refreshing - google if (alltags[i].getAttribute('avglschecked')) continue; } // mark search result anchor so it isn't processed repeatedly alltags[i].setAttribute('avglschecked', '1'); // ignore linked resources if (alltags[i].tagName == 'LINK') continue; // ignore in-page bookmarks and javascript if ((!alltags[i].href) || (alltags[i].href.charAt(0) == '#') || // in-page bookmark (alltags[i].href.indexOf("javascript") == 0)) continue; // ignore verdicts if (/XPLSS_/.test(alltags[i].id)) continue; // ignore flyover anchors if (/avgthreatlabs/.test(alltags[i].host)) continue; var href = engine.includeLink(alltags[i]); if (!href) continue; var newNode = engine.search.addLink(alltags[i], href); engine.addImage(newNode, engine.search.clockUrl, false); } // recursivesly process all frames var docFrames = doc.frames; if (docFrames && engine.processFrames) { for (var j = 0; j < docFrames.length; j++) { var attr; var frameDoc; try { attr = docFrames[j].frameElement.className; frameDoc = docFrames[j].document; } catch(err){} //TODO: make frame processing an engine function or at least make exclusions an engine property // 'editable' frame it's probably a gmail reply if (attr && (attr.indexOf("editable") != -1)) continue; if (frameDoc) searchshield.avgGetSearchLinks(frameDoc, engine, 0); } } return engine.search.links;};searchshield.avglsCheckandUpdate = function (linkNode){ if (!xplSearch) return; // element is the search result anchor var element = linkNode.element; var href = linkNode.href; var result = searchshield.avgCallFunc(xplSearch.doc, 'CheckSite', href, element.href); if (result == null) return; var resultParse = result.split('::'); var phishing = resultParse[0]; // if phishing then rest of array does not exist. if (phishing == 1) return true; if (resultParse.length < 8) return; var hash = resultParse[1]; var score = resultParse[2]; var new_image = resultParse[3]; var alt_image = resultParse[4]; var flyover = resultParse[5]; var click_thru= resultParse[6]; var altClick_thru = resultParse[7]; // iterate to get verdict anchor nextElem = element.nextSibling; while (nextElem) { if (nextElem.nodeType == 1 && nextElem.id && (nextElem.id.indexOf("XPLSS_") != -1)) break; nextElem = nextElem.nextSibling; } return xplSearch.engine.updateImage(hash, xplSearch.searchHash, score, new_image, alt_image, flyover, click_thru, altClick_thru);};// click event handler - shows popup for links of caution and warning severitysearchshield.blockClick = function(event){ if (!event) event =