7

I have disabled JavaScript using the Firefox extension uMatrix and yet some websites are still able to force page reloads at an interval referenced by a script on that page. How is this possible please, and can I prevent it?

For example, https://www.drudgereport.com/ contains the following script tag meant to reload the page every 105 seconds:

<script type="text/javascript">
<!-- 
var img = new Image(), url = "/204.png", container = document.getElementById("div-204");
img.onload = function () { container.appendChild(img); };
img.src = url;
var timer = setInterval("__drudge__321__autoRefresh()", 1000 * 35 * 3);
function __drudge__321__autoRefresh(){self.location.reload(true);}
(function () {
    var __oldClearInterval = clearInterval;

clearInterval = function (arg) {
    if(arg == timer) {
            console.log(&quot;clearInterval of TIMER intercepted! (&quot; + arg + &quot;)&quot;);
    }
    else {
            __oldClearInterval(arg);
    }
}



})();
//--> 
</script>

With JavaScript disabled, the page still reloads every 105 seconds, indefinitely. My expectation is that when I disable JavaScript, scripts embedded in the page are prevented from executing.

Tom Brossman
  • 313
  • 1
  • 2
  • 7
  • 5
    This has nothing to do with security. – ThoriumBR Nov 02 '20 at 12:57
  • 8
    @ThoriumBR I'm happy to delete the question if it is off-topic here. I thought JavaScript was somehow being executed, and my first thought was that it was a security problem. The accepted answer explains it now. – Tom Brossman Nov 02 '20 at 13:29
  • Unwanted reloads is one of the most annoying "feature" of the Web, together with video auto-start. Although understanding the way they work is important for security, the fact they exist is not in itself a security issue, but a usability issue. How to disable JS is both a usability issue (some JS features can be pretty annoying) and a security issue. – curiousguy Nov 02 '20 at 22:58
  • Look into HTML meta refresh. – multithr3at3d Nov 03 '20 at 03:03

1 Answers1

25

The page refreshes periodically because of this tag:

<meta http-equiv="refresh" content="105">

That asks the browser to refresh, without needing JavaScript.

Sjoerd
  • 30,589
  • 13
  • 80
  • 107
  • 15
    ... and the page could achieve that goal even without adding that tag to its content by using the corresponding http-header directly – Hagen von Eitzen Nov 02 '20 at 21:13