How to verify that the properties of the window object are native?

Question

I’m using Shim that modifies several of the properties in the window object of browsers.

At this point I need to validate whether one of the specified properties is native or a Shim. Because Shim can modify the native property.

For example:

(function () {
  var native = window.alert;
  window.alert = function (): {
    /* faz alguma coisa */
    console.log(arguments);
    return native.apply(this, arguments);
  };
})();

In the example we can see that it does not change the functionality of alert applying the original at the end, but this alert is no longer the original in another code snippet I would like to know if this method is the original or a modified.

The alert was used only as example purposes of the problem.

Without modifying the "Shim" that no longer exposes the alert native, how to access the alert native to compare with the modified and know that the function in the window is not the native?

Answer 1

I don’t know how much this would be compatible with all browsers, but if you convert the function to string, you’ll see the source code in the case of non-native functions, and a string containing [native code] the native ones. For example, in the case of your variable native (tested on the Chrome console):

native.toString(); // function alert() { [native code] } 

Based on this, one can create a function to verify this:

function nativa(fn) {
    return typeof fn == 'function' && fn.toString().indexOf('[native code]') > -1;
}

Answer 2

A native function will return function () { [native code] } when converted to string.

var nativa = typeof funcao === 'function ' && funcao.toString().indexOf('[native code]') !== -1

On the other hand this does not work if the function Function.prototype.toString has been modified.

You can access native javascript functions using another window (an iframe or popup) and compare them:

function retrieveNative(native) {
  var iframe = document.createElement('iframe');
  document.head.appendChild(iframe);
  var retrieved = iframe.contentWindow[native];
  document.head.removeChild(iframe);
  return retrieved;
}
var alertNativo = retrieveNative('alert');

Remark: The right thing to do is to body the iframe, but if it has not been loaded yet, it will generate an exception, putting in the head will not carry the iframe but it will provide access to window which is the objective in this case.

Credits to @bfavaretto for the change in comments.

Answer 3

To restore a native function, we can use the delete. Example:

delete window.alert;

So, by applying this to a function that deletes and restores the initial value, we can verify that the function is native without the hack iframe:

function isNative(object, name) {
    var aux = object[name]; //salva o valor
    delete object[name]; //apaga a função
    var result = object[name] == aux; //se continuar a mesma é porque é nativa
    object[name] = aux; //restaura a anterior, caso não seja a nativa
    return result;
}

Testing:

console.log(window.alert, isNative(window, 'alert'));
window.alert = function() { }
console.log(window.alert, isNative(window, 'alert'));
delete window.alert;
console.log(window.alert, isNative(window, 'alert'));

Exit:

True

False

True

Jsfiddle

Note: is technical does not work in some browsers if the function has been set with the function Object.defineProperty and the parameter writable : false. See the fiddle test. In Chrome there were no problems, but in Firefox the function returned true when it should be false.

Note 2: also does not work if the function definition is done directly in the global scope, for example:

function alert() { ... }

Answer 4

One possibility is to "backup" the window before running your Scan. After that you can compare the values of the functions with the old value of the backup to see if there was a change.

//Coloque esse código em uma tag <script> anterior à tag <script> com o shim.
var window_backup = {}
for(var k in window){
    window_backup[k] = window[k];
}

function is_native(key){
   return window[key] === window_backup[key];
}

The main advantage of this approach is that you do not depend on implementation details as the result of the toString function and do not need to mess with the window object after you run the Shim.