Forum Moderators: open
I have a problem which is caused by Norton Internet Security inserting the "symerror" function into all webpages. If you are not familiar with this function it basically will insert the following into a web page:
<script language="JavaScript">
<!--
function SymError()
{
return true;
}
window.onerror = SymError;
//-->
</script>
The problem I have is that my HTML page needs to call an externally loaded javascript file. Tgus in the HTML file I have <Script language="javascript" src="theJSfile."></script>. "theJSfile" is formated like this:
document.write ('<SCRIPT language="JavaScript" src="http://www.webpage.com/..."></SCRIPT>')
The problem arises because Norton Internet Security sticks its little symerror function just above the first <script language="javascript"> reference it finds in the document. This happens to be in the middle of the 'document.write' statement.
The net result of this is you end up with the following which is supposed to be Javascript:
document.write ('
<script language="JavaScript">
<!--
function SymError()
{
return true;
}
window.onerror = SymError;
//-->
</script>
<SCRIPT language="JavaScript"
src="http://www.blah.js"></SCRIPT>')
Note that now the document.write command is broken by a carriage return.
Is there any way that I can make the document.write function not die at the carriage return?
I hope this makes sense!
Thanks.
It looks like Norton kicks in directly after
document.write('It's important to make sure, not only that this doesn't cause you errors, but also that their code isn't executed. You won't be able to get any error reports for your own debugging.
If Norton is reacting specifically to
document.write()document.myWrite = document.writeThen you could use your new method name from then on (which is admittedly a stupid position to be in).
Try inserting the following in your header:
<script></script>
and see if norton moves it's script near that.
/*<script language="javasvript"></script>*/
The Norton function is triggered by the <script> and it inserts it immediately before the first <script> in a file. It does not check to see if that section is commented out. Thus the Norton function is now useless and it does not interfear with my document.write() command.
Geez... things like this really tick me off about programming. I had 15 things that had to be done today, and spent the entire day solving this stupid issue. Ahhhh!
Thanks again for the help!
AC
I've considered blocking out users who have their referrer blocked ... redirecting them to another page that tells them why they're blocked and how to become "unblocked" so they can access the site. Maybe I'm the only one who thinks this way, who knows.
Is this just something that happens when you view your pages locally, or is it something that this flavour of Norton will do to all webpages?
Do we have to start compiling a list of workarounds like yours, and all the other junk we need to put in to combat the junk they put in?
----------------------------------------
If you want your error alerts back, override their SymError with your own, a little later in the script.
function SymError(){ return false;}
*Before* your first <script> insert this into the html
<!-- <script language="javascript"></script> Workaround comment for Norton Firewall -->
Norton sees the <script> reference and does its strange insertion but Norton does not see that this <script> is remarked. So it has not further effect on the code.
Let us know if it works for you!
Man I hate norton internet security ... specifically the referrer blocking feature.
It also plays havoc with Adsense and other ads. Not good.
I have some ads on my website, and for some reason I can't see them, but other people can. I tried adding those lines before the code but it still wont show. I have Norton and IE.
Thanks for your help.
Edit: Heres the error im getting starting from the beginning of the ad to the end.
<!--- Start ****.com Ad Code ----->
<script language="JavaScript">
<!--
function SymError()
{
return true;
}
window.onerror = SymError;
var SymRealWinOpen = window.open;
function SymWinOpen(url, name, attributes)
{
return (new Object());
}
window.open = SymWinOpen;
//-->
</script>
<script type='text/javascript'>
<!--
var ****_webmaster_id = 10398;
var ****_site_id = 13653;
var ****_ad_size = '234x60';
//-->
</script>
<!--- End ****.com Ad Code ----->
Edit: For some reason its blocking of the site. the ad is from ad+hearus.com (without the +)
<!-- <script language="javascript"></script> Workaround comment for Norton Firewall -->
It didn't work. Norton ignored it and placed its stuff before the next real script tag. Like this:
<!-- <script language="javascript"></script> Workaround comment for Norton Firewall -->
<meta http-equiv="Content-Script-Type" content="text/javascript" />
<script language="JavaScript">
<!--
function SymError()
{
return true;
}
window.onerror = SymError;
var SymRealWinOpen = window.open;
function SymWinOpen(url, name, attributes)
{
return (new Object());
}
window.open = SymWinOpen;
//-->
</script>
<script src="scripts-js/lib-standard-02.js" type="text/javascript"></script>
Has Norton found a way to get around this trap? Or am I doing it wrong?
<!--
<script type="text/javascript">
</script>
-->
If we're real lucky, Norton may insert in the comment area and nullify itself.
Norton appears to intercept the data stream between the modem and the browser, because it does its insertion regardless what browser you are using. This is a bit much, since only IE users need it.
In my experience, Norton also appends some JavaScript after the closing </html> tag. Browsers, being overly accommodating of such things, go ahead and read it.
It's really the code at the end which is the killer, since it can supercede the code you've written. Though the code above obviously subverts the window.open() method and turns the window into a generic object.
I have not looked at this issue since I originally posted. But there is little point in inserting <!-- and -->. Javascript doesn't ignore these commands, HTML does! They are, of course, designed for old non-JS browsers to ignore javascript commands.
What you have to insert is /* and */. These commands comment out entire blocks of JS. So, you place the following at the top of your file:
/*
<script language="javascript">
</script>
*/
And then you will find that Norton will change it and you will end up with:
/*
function SymError()
{
return true;
}
<script language="javascript">
</script>
*/
I hope this makes sense. I have quite a complex JS script and the above works perfectly, so unless we are dealing with a new version of Norton (etc...) I see no reason why it should not work for you.
The ideal would be to eliminate not just the Norton stuff inserting itself in the middle of things, but to disable it. I realize your initial post was not of that nature and did utilize the JavaScript comment notation.
Arghh!
The script works on the page, but when I move it off of the page to a linked file the page crashes across every browser I have tried.
Work arounds listed here do not seem to be effective. Anybody found anything else that works?
<added>Looks like noscript tags don't help either<added>
WBF
<added>Found this [service1.symantec.com] too. What a crock. Norton does not seem to recognize this as a problem inherent in their software, and gives directions to "fix" it that virtually no one will find or use.</added>
WBF
<!--
/*
<script language="javascript">
</script>
*/
-->That hides the Javascript code from HTML while causing the Symantec code to be ignored.
However, that kind of defeats the purpose of a lot of Norton Internet Security (which probably won't bother many Web masters, but could bother your visitors).
If you don't want to disable NIS, wouldn't the following work?
<script language="javascript">
</script>If you put that ahead of any other scripts, that should give NIS a safe place to insert its code while still keeping it enabled for users who want it.
Steve
P.S. I'm glad I found this thread. I was just Googling to find out what those Sym* functions were, and this not only answered my questions but also provided a link to a Symantec page that helped me get a site working properly again. David Letterman's site uses popups to play video and audio, and those had stopped working in my browsers unless I turned off NIS and refreshed the page. The rules I had created didn't seem to allow the popups, but now I have some that do.
She has NIS (Norton Internet Security)enabled and two of my websites with a form have a javascript related problem as described at the beginning of this thread.
I tried the fixes to my sites by adding the
/*<script language="javasvript"></script>*/
but with no success. The solution lay in NIS "Privacy Control" which when customised for my URL fixed the problem and allowed the full form to display in IE 6.0.
The problem is how many users are out there with that type of configuration in NIS? On one site I came to my home page via a link on another site only to arrive and see the page completely broken. After clicking on the banner it brought me to a valid page.
I'm wondering how many sites are displaying badly due to users with NIS who don't't know they have a problem. All my experiences with NIS have been bad.
<script language="Javascript">
<!--
if(window.SymError)
{
window.onerror=null;
window.onerror=SymError2;
}
function SymError2()
{
alert('The functionality you would like to use has been broken by the hatchet '+
'style programming in your Norton Internet Security software.\n\nWe '+
'use clean javascript on this website to leverage your modern browser '+
'and deliver a useful website. Norton\'s IS product disables some '+
'javascript like a dentist using pliers to fix teeth.\n\nYou might want '+
'to ask them for a refund or a better product.');
return true;
}
//-->
</script>
I found out one thing the hard way!
Symantec Norton antivirus has a very stupid implementation.
It blocks all links used in Javascript, that have either the word "ad" or "ads" as part of the URL!
And because of this lots of legitimate URLs which are not malicious are getting blocked, giving the functionality of some sites a good beating...
I am very surprised by the way Symantec is hiding this issue... They are just telling "Just put the ad blocker off" ..
Hope this info helps you all.
-Sandeep
document.write('<sc'+'rip'+'t type="text/javascript" src="foobar.js">'+'</s'+'crip'+'t>');
