Orange and SFR replace certain words by "java-script" #7

Open
hteumeuleu opened this Issue Oct 9, 2015 · 3 comments

Comments

Projects
None yet
1 participant
@hteumeuleu
Owner

hteumeuleu commented Oct 9, 2015

The french webmail of Orange replaces every occurrences of certain words by java-script(even when they're used in a sentence, or are part of a URL). I reported this on my blog two weeks ago after seeing it affected the word overflow (causing a potential security issue for Stack Overflow emails for example). I've since tested the keywords from this Event reference in JavaScript. Here are the words affected :

  • CheckboxStateChange
  • DOMActivate
  • DOMAttrModified
  • DOMCharacterDataModified
  • DOMFocusIn
  • DOMFocusOut
  • DOMMouseScroll
  • DOMNodeInserted
  • DOMNodeInsertedIntoDocument
  • DOMNodeRemoved
  • DOMNodeRemovedFromDocument
  • DOMSubtreeModified
  • dragdrop
  • dragexit
  • draggesture
  • onabort
  • onafterprint
  • onbeforeprint
  • onbeforeunload
  • onblur
  • oncanplay
  • oncanplaythrough
  • onchange
  • onclick
  • oncontextmenu
  • oncopy
  • oncut
  • ondblclick
  • ondrag
  • ondragdrop
  • ondragenter
  • ondragleave
  • ondragover
  • ondragstart
  • ondrop
  • ondurationchange
  • onemptied
  • onended
  • onerror
  • onfocus
  • onhashchange
  • oninput
  • oninvalid
  • onkeydown
  • onkeypress
  • onkeyup
  • onload
  • onloadeddata
  • onloadedmetadata
  • onloadstart
  • onmessage
  • onmousedown
  • onmouseenter
  • onmouseleave
  • onmousemove
  • onmouseout
  • onmouseover
  • onmouseup
  • onmousewheel
  • onoffline
  • ononline
  • onpagehide
  • onpageshow
  • onpaste
  • onpause
  • onplay
  • onplaying
  • onpopstate
  • onprogress
  • onratechange
  • onreadystatechange
  • onreset
  • onresize
  • onscroll
  • onseeked
  • onseeking
  • onselect
  • onstalled
  • onstart
  • onstorage
  • onsubmit
  • onsuspend
  • ontimeupdate
  • onunload
  • onvolumechange
  • onwaiting
  • overflow
  • RadioStateChange
  • underflow

@hteumeuleu hteumeuleu added the bug label Oct 9, 2015

@hteumeuleu

This comment has been minimized.

Show comment
Hide comment
@hteumeuleu

hteumeuleu Oct 12, 2015

Owner

The same thing happens on SFR's webmail, but with a smaller list of keywords filtered. Based on the previous list from Orange, here are the words that SFR replaces with java-script.

  • onabort
  • onafterprint
  • onbeforeprint
  • onbeforeunload
  • onblur
  • onchange
  • onchange
  • onclick
  • oncontextmenu
  • oncopy
  • oncut
  • ondblclick
  • ondragdrop
  • ondragenter
  • ondragleave
  • ondragover
  • ondrop
  • onerror
  • onerror
  • onfocus
  • onkeydown
  • onkeypress
  • onkeyup
  • onload
  • onmousedown
  • onmousemove
  • onmouseout
  • onmouseover
  • onmouseup
  • onpaste
  • onprogress
  • onreadystatechange
  • onreset
  • onresize
  • onscroll
  • onselect
  • onstart
  • onsubmit
  • onunload
Owner

hteumeuleu commented Oct 12, 2015

The same thing happens on SFR's webmail, but with a smaller list of keywords filtered. Based on the previous list from Orange, here are the words that SFR replaces with java-script.

  • onabort
  • onafterprint
  • onbeforeprint
  • onbeforeunload
  • onblur
  • onchange
  • onchange
  • onclick
  • oncontextmenu
  • oncopy
  • oncut
  • ondblclick
  • ondragdrop
  • ondragenter
  • ondragleave
  • ondragover
  • ondrop
  • onerror
  • onerror
  • onfocus
  • onkeydown
  • onkeypress
  • onkeyup
  • onload
  • onmousedown
  • onmousemove
  • onmouseout
  • onmouseover
  • onmouseup
  • onpaste
  • onprogress
  • onreadystatechange
  • onreset
  • onresize
  • onscroll
  • onselect
  • onstart
  • onsubmit
  • onunload

@hteumeuleu hteumeuleu changed the title from Orange replaces certain words by "java-script" to Orange and SFR replace certain words by "java-script" Oct 12, 2015

@hteumeuleu

This comment has been minimized.

Show comment
Hide comment
@hteumeuleu

hteumeuleu Oct 17, 2015

Owner

Based on this article by Jeff Atwood, I realized Orange also replaces Jscript by j-script, Vbscript by vb-script and Livescript by live-script. And that's something Yahoo also did in 2001.

Owner

hteumeuleu commented Oct 17, 2015

Based on this article by Jeff Atwood, I realized Orange also replaces Jscript by j-script, Vbscript by vb-script and Livescript by live-script. And that's something Yahoo also did in 2001.

@hteumeuleu

This comment has been minimized.

Show comment
Hide comment
@hteumeuleu

hteumeuleu Mar 2, 2018

Owner

As suggested today by @M-J-Robbins on the Emailgeeks Slack, the following code can be used to target Orange.

<style>
.java-script { }
</style>
<div class="overflow"></div>
Owner

hteumeuleu commented Mar 2, 2018

As suggested today by @M-J-Robbins on the Emailgeeks Slack, the following code can be used to target Orange.

<style>
.java-script { }
</style>
<div class="overflow"></div>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment