Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

CSS/JavaScript/hacking: Detect :visited styling on a link *without* checking it directly OR do it faster than me

Tags:

This is for research purposes on http://cssfingerprint.com

Consider the following code:

<style>   div.csshistory a { display: none; color: #00ff00;}   div.csshistory a:visited { display: inline; color: #ff0000;} </style>  <div id="batch" class="csshistory">   <a id="1" href="http://foo.com">anything you want here</a>   <a id="2" href="http://bar.com">anything you want here</a>   [etc * ~2000] </div> 

My goal is to detect whether foo has been rendered using the :visited styling.

  1. I want to detect whether foo.com is visited without directly looking at $('1').getComputedStyle (or in Internet Explorer, currentStyle), or any other direct method on that element.

    The purpose of this is to get around a potential browser restriction that would prevent direct inspection of the style of visited links.

    For instance, maybe you can put a sub-element in the <a> tag, or check the styling of the text directly; etc. Any method that does not directly or indierctly rely on $('1').anything is acceptable. Doing something clever with the child or parent is probably necessary.

    Note that for the purposes of this point only, the scenario is that the browser will lie to JavaScript about all properties of the <a> element (but not others), and that it will only render color: in :visited. Therefore, methods that rely on e.g. text size or background-image will not meet this requirement.

  2. I want to improve the speed of my current scraping methods.

    The majority of time (at least with the jQuery method in Firefox) is spent on document.body.appendChild(batch), so finding a way to improve that call would probably most effective.

    See http://cssfingerprint.com/about and http://cssfingerprint.com/results for current speed test results.

The methods I am currently using can be seen at http://github.com/saizai/cssfingerprint/blob/master/public/javascripts/history_scrape.js

To summarize for tl;dr, they are:

  1. set color or display on :visited per above, and check each one directly w/ getComputedStyle
  2. put the ID of the link (plus a space) inside the <a> tag, and using jQuery's :visible selector, extract only the visible text (= the visited link IDs)

FWIW, I'm a white hat, and I'm doing this in consultation with the EFF and some other fairly well known security researchers.

If you contribute a new method or speedup, you'll get thanked at http://cssfingerprint.com/about (if you want to be :-P), and potentially in a future published paper.

ETA: The bounty will be rewarded only for suggestions that

  • can, on Firefox, avoid the hypothetical restriction described in point 1 above, or
  • perform at least 10% faster, on any browser for which I have sufficient current data, than my best performing methods listed in the graph at http://cssfingerprint.com/about

In case more than one suggestion fits either criterion, the one that does best wins.

ETA 2: I've added width-based variants of two previous-best test methods (reuse_noinsert, best on Firefox/Mozilla, and mass_insert, its very close competitor). Please visit http://cssfingerprint.com several times from different browsers; I'll automatically get the speed test results, so we'll find out if it's better than the previous methods, and if so by how much. Thanks!

ETA 3: Current tests indicate a speed savings using offsetWidth (rather than getCalculatedStyle/currentStyle) of ~2ms (1.8%) in Chrome and ~24ms (4.3%) in Firefox, which isn't the 10% I wanted for a solid bounty win. Got an idea how to eke out the rest of that 10%?

like image 971
Sai Avatar asked Mar 07 '10 02:03

Sai


People also ask

What does the CSS visited keyword do?

The :visited CSS pseudo-class represents links that the user has already visited. For privacy reasons, the styles that can be modified using this selector are very limited.

How do I reset my visited links?

Links appear as "visited" when the browser chooses to apply the :visited CSS pseudo-class. The client-side way to reset links to the unvisited state is to (somehow) clear the browsing history.

How do you check the link is visited or not?

You can parse all links on the page and and get their CSS color property. If a color of the link is a match to the color of unvisited link you defined in CSS the this link is unvisited. This kind of technique usually used to determine all visited links.

Which link shows visited link?

A visited link is underlined and purple. An active link is underlined and red.


1 Answers

[new update]

If you wanted the results just for visual presentation then the fastest method would be to use CSS counter..

CSS:

body{     counter-reset: visited_counter; }  a:visited{     counter-increment: visited_counter; }  #results:before{     content:counter(visited_counter); } 

This would add the number of visited links before the element with id 'results'.

Unfortunately there is no way to access it from JavaScript, you can only display it..


[initial answer]

You are aware that jQuery supports the :visited selector directly right?

Like $('a:visited')

[update]

As an alternative, you could apply a CSS property that does not rely to the getComputedStyle to retrieve..

Like a:visited{height:1px;display:block;} and then check for offsetHeight.

like image 197
Gabriele Petrioli Avatar answered Oct 07 '22 21:10

Gabriele Petrioli