如何阻止 javascript 重定向页面？

Question

We run a few popular websites and are having issues with ads redirecting mobile users to other websites and app stores when the page loads. Is there a way to block javascript from changing the url?

I have a couple ideas but haven't made anything work yet:

• use beforeunload to stop from directing away from the page but I need away to tell if the user meant to leave by clicking on something

• use window.MutationObserver to monitor DOM but I'm not sure this can be used to monitor changes to window.location

Anyone have a solution?

UPDATE

I tried the suggestion below to add the "sandbox" attribute to the iframe that holds the ad. On my test page it did stop my page from running the redirect but it didn't stop the ad redirects when I made this live! So I'm guessing they are redirecting the page with another method that gets through the sandbox block. Anyone have any ideas how they could be doing this?

example iframe:
<iframe sandbox="allow-forms allow-pointer-lock allow-scripts" ..

example iframe html (redirect):
window.top.location.href = "example.com";

Answer 1

If the ads are in an iFrame add the sandbox attribute to the iFrame tag. Per w3schools it will prevent the following...

• treat the content as being from a unique origin
• block form submission
• block script execution
• disable APIs
• prevent links from targeting other browsing contexts
• prevent the content to navigate its top-level browsing context
• block automatically triggered features (such as automatically playing a video or automatically focusing a form control)

NOTE - this is a HTML5 feature, and won't work in older browsers

Answer 2

When using standard javascript tags, the easiest solution is to increase your mobile tag floors above ~$0.45 (you should not need to go higher than $0.55).

For the most part we see mobile redirects mostly come in on 300x250 sizes, but have also seen it on 728x90 particularly when displayed on mobile (as 728x90 is more geared for desktop and demand for that size is extremely low on mobile meaning the bad ads win by paying a cheaper price).

If you are using prebid.js, other header bidding or multi-bid tags, in most cases you will have the ability to programmatically inspect the ad payload before you append the unit code to the page.

This provides an excellent opportunity to regex / search the ad payload string for code that sets window.location, and enables the developer to take specific actions when detected (such as bypass the bad ad and instead display a trusted remnant solution or house ad).