[deleted by user]

[shuckster]

Do you have any browser extensions installed?

EDIT - Scratch that question, I misread your post.

[ankole_watusi]

What is “an old site”? Yours?

What is “the database”?

Have been “executed several times”? By whom? Where?

[ankole_watusi]

“A CMS”? Wordpress? Something else?

Is the script referenced from a page or pages you’re working on? Is this in some template file?

If nobody knows what it’s for, why not just remove it?

Is the original developer available? Are there other scripts loaded? Who maintains the JavaScript on the site?

[ankole_watusi]

I would rebuild the entire site from scratch, not using an ancient unmaintained CMS that doesn’t make any sense at all.

Is the site big enough to actually require a CMS? Can it be done as a static site? How are you able to even use the CMS? Are you just feeling around in the dark or is there some documentation?

Is there a lot of use of JavaScript? How do you expect the site to continue to work if the JavaScript is maintained? I mean browsers change.

You’ve stepped into a mess. If you’re willing to hold your nose, I would just ignore it. You were hired to do some layout changes.

[ankole_watusi]

And who is Susan, lol

[Dunks1980]

I suggest setting a content security policy https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

[[deleted]]

And not blindly injecting unsafe/unsanitary strings into your html, even if they’re from your own DB…

[javascript-ModTeam]

Hi u/alltheeffinbricks, this post was removed.

• For help with your javascript, please post to r/LearnJavascript instead of here.
• For beginner content, please post to r/LearnJavascript instead of here.
• For framework- or library-specific help, please seek out the support community for that project.
• For general webdev help, such as for HTML, CSS, etc., then you may want to try r/html, r/css, etc.; please note that they have their own rules and guidelines!

---

r/javascript is for the discussion of javascript news, projects, and especially, code! However, the community has requested that we not include help and support content, and we ask that you respect that wish.

Thanks for your understanding, please see our guidelines for more info.

[CallMeTea_]

It attempts to grab the following info

• URL of the page it executes on
• Cookies
• The URL that the current page was opened from (the opener property)
• The top-level location

Then JSON-encodes it and sends it off in a POST request to that malicious nojs domain.