Using jQuery to disable everything on a page. Break my code

For my current project, 开发者_如何学PythonI require the facility to be able to remove all functionality from a page, so that it is complete and literal static page. Removing the ability to follow any links, and disabling and javascript listeners allowing content to be changed on the page. Here is my attempt so far:

$("*").unbind().attr("href", "#");

But in the pursuit of a perfect script, and to allow it to work in every eventuality for any possible page (and with the uncertainty of a on liner being effective enough), I thought i'd consult the experts here at stackOverflow.

In summary, my question is, 'Can this be (and has it been) done in a one liner, is there anything this could miss?'. Please break this as best you can.

No. Nothing in this stops meta redirects, or timeouts or intervals already in flight, and it does nothing about same origin iframes (or ones that can become same origin via document.domain) that can reach back into the parent page to redynamize content.

EDIT: The sheer number of ways scripts can stay submerged to pop up later is large, so unless you control all the code that can run before you want to do this, I would be inclined to say that it's impossible in practice to lock this down unless you have a team including some browser implementors working on this for some time.

Other possible sources of submarine scripts : XMLHttpRequests (and their onreadystatechange handlers), flash objects that canscript, web workers, and embedding code to run in things like Object.prototype.toString.

I did not want to write a lengthy comment so I'm posting this instead.

As @Felix Kling said, I don't think your code will remove the href attributes on every element but rather remove every element and then select their href attributes.

You probably need to write:

$("*").attr("href", "#").detach() ;

to remove the attributes instead of the elements.

Other than that, I doubt that you could remove the event handlers in one line. For one thing you would need to account for DOM level 2 Event registration (only settable with scripting) and DOM level 1 Event registration (via attributes or scripting).

As far as I'm concerned, your best bet is to make a shallow document copy using an XML parser and replace the old document (which you could backup-save to the window).

First: Your code will remove everything from the page, leaving a blank page. I cannot see how it would make the page "static".

$('*').detach();

will remove every element form the DOM. Nothing left. So yes, you remove every functionality in a way, but you also remove all the content.

Update: Even with the change from detach to unbind, the below points are still valid.

• Event listeners added in the markup via oneventname="foo()" won't be affected.
• javascript: URLs e.g. in images might still be triggered.
• Event listeners added to window and document will persist.

See a DEMO.