5

I've recently started using a 3G mobile broadband usb stick. It's from T-Mobile, a UK mobile commmunications company. All seemed well, until I tried to test a site which I've been developing locally on by uploading it to my live server.

When I look at the code of my live site, I can see that 2 things strange are happening:

  1. A script is being inserted into the head of my documents specifically: <script src="http://1.2.3.8/bmi-int-js/bmi.js" language="javascript"></script>

    Is there something I can put in my code to prevent script insertion?

  2. Normally my css is included in my page like:

    <link href="style.css" rel="stylesheet" type="text/css" />

however now when I look in my source, the css has been inserted directly into the page between script tags like:

<style type="text/css" style="display:none">div.calendar{color:#000;font-family:Verdana,Geneva,Arial,Helvetica,sans-serif;-moz-box-shadow:0px.....

This is happening for some javascript files also.

What is going on?

11

The modifications you're seeing aren't actually present in your site's markup. I've visited your site and can verify this. What's happening is, T-Mobile is trying to "optimize" any site visited using your wireless stick, and doing a bad job of it. This guy's reporting the same problem:

It turns out that T-Mobile (and Vodafone UK) think it is appropriate to insert their own Javascript into each page which I visit, which pipes all images through a proxy to degrade their quality. However, due to an improperly terminated newline, this script cannot be parsed by Firefox or Opera in conjunction with any XHTML 1.1 or XML documents.

Here's the first few lines of your head, as I see it:

<head> 
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> 
<title>The Smile Zone | Home</title> 
<link rel="stylesheet" type="text/css" href="manager/templates/smiletemplate/css/style.css" /> 
<link type="text/css" rel="stylesheet" href="http://www.jotform.com/css/styles/form.css?v3"/> 
<link href="manager/templates/smiletemplate/css/calendarview.css" rel="stylesheet" type="text/css" /> 

I don't know if you can override this behavior of your wireless service, but you can rest assured that other visitors to your site aren't having the same issues.

  • Can you confirm for me that css is included in a seperate file, not between style tags? This is a massive relief for me if you can. Thanks for the above info. – Ash Sep 26 '10 at 20:21
  • I can confirm it: <link type="text/css" rel="stylesheet" href="http://www.jotform.com/css/styles/form.css?v3"/>. That file contains CSS starting with "*Form CSS". – Michael Petrotta Sep 26 '10 at 20:23
  • I see three or four inline styles; the vast majority are coming from those stylesheets. – Michael Petrotta Sep 26 '10 at 20:27
  • Thanks so much. Lifesaver – Ash Sep 27 '10 at 7:34
0

Is there something I can put in my code to prevent script insertion?

If you set the Content-Security-Policy HTTP header for your website, you'll be able to stop the injected script from being able to load in modern browsers.

See "html5rocks: An Introduction to Content Security Policy" to get started. However, with such a policy you'll have to be careful not to deny resources that your own website requires, e.g. Google fonts, CDNs, etc. and that can be time-consuming to get right.

Example, the following HTTP header will only allow modern browsers to fetch resources from your website's own domain, thus preventing the external BMI script from being fetched:

Content-Security-Policy: default-src 'self';
4

In T-mobile it's called "Mobile Broadband Accelerator" You can Visit: http://accelerator.t-mobile.co.uk or http://1.2.3.50/ to disable/configure it. Also please have a look at Stop mobile network proxy from injecting JavaScript

  • 1
    It's funny because one of the things they do is strip all comments from javascript, which almost amounts to a breach of the terms of any license which requires attribution and copyright notice retention as terms for distribution. – Flexo Oct 13 '11 at 19:15
1

If you load the website using SSL or browse using a VPN (or Tor) then your ISP won't be able to see the data to modify it. This doesn't necessarily help your users, though.

protected by Robert Harvey May 30 '12 at 14:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.