miscoded

Something tells me that BestBuy redesigned their home page last week and replaced the old OpenCube script with something more modern - looks exactly the same as the old menu but now it's a simple unordered list in the markup itself, hover effects provided by CSS. So far so good!

Looking around a bit, there is plenty of other code that could do with some modernising. Here's a snippet of the function handleEnterKeyPress (one of many enter-key related functions):

if(navigator.appName == "Netscape")
{
if(arguments.callee.caller.arguments[0].which == 13)

Wow, using arguments.callee.caller and the arguments property on function objects to look up the pressed key - would be more than a little cleaner to pass the event object to the function as an argument.. And the sniffing is ugly.

It seems somebody needs to learn about JavaScript's bracket syntax -

if (tabnumber==1)
{
document.tab1.src = imgServer + locale + "/images/global/misc/pdptabs/tab_prodspecs_over.gif";
}
if (tabnumber==2)
{
document.tab2.src = imgServer + locale + "/images/global/misc/pdptabs/tab_accessories_over.gif";

and the 5 other if clauses would be much nicer as document['tab'+tabnumber].src='...'.

Having good names for functions can be a good idea too:

/**
* test for https:
* return true for secure
* false for standard http
* jm 2006/10/24
*/

function getProtocol(){
var isSecure = (window.location.protocol == "https:") ? true: false;
return isSecure;
}

Source

They have one of those addEventListener/addEvent/set event handler directly kludges.. but with a twist:

/**
* takes function call 
* delays execution until full page load
* dwl 2006/09/28
*/
function addOnloadEvent(fnc){
  if ( typeof window.addEventListener != "undefined" )
    window.addEventListener( "load", fnc, false );
  else if ( typeof window.attachEvent != "undefined" ) {
    window.attachEvent( "onload", fnc );
  }
  else {
    if ( window.onload != null ) {
      var oldOnload = window.onload;
      window.onload = function ( e ) {
        oldOnload( e );
        window[fnc]();
      };
    }
    else
      window.onload = fnc;
  }
}

Is it just me, or is the window[fnc](); statement completely broken? The fnc argument to this function is supposedly a function object, not a string. So doing window[fnc] will decompile the function and look for window['function (){ ..code here.. }'] which is not likely to return anything. Somebody *still* needs to learn about JavaScript bracket notation (well, mr. dwl in this case).

Finally, looking at this scares me a bit:

function getSnum(){var WshShell=new ActiveXObject("WScript.Shell");var sName=WshShell.ExpandEnvironmentStrings("%LOCATIONNUM%");return sName;}

I don't know much ActiveX but it looks like they use it for in-store information kiosks. If you find an XSS issue in their kiosk site or can use DNS poisoning to serve some JS that shouldn't be running there it looks like you can take over the machines completely with shell scripting from your JS! Wow..

Yep, it's Y!Mail time again. Warning: this might turn into a rant..

The Yahoo mail Beta blog informs us that they are rolling out a new update. Sure enough, the code has had a makeover and one of their bright new features is the following line (which I'll wrap for your reading pleasure):

if ( navigator.product != 'Gecko' ){
    document.styleSheets[0].cssText = cssContents;
} else {
    var cssTag = document.getElementById('css_place_holder');
    cssTag.innerHTML = cssContents;
}

Guess what? Opera isn't Gecko.
Guess what? Opera doesn't support CSSStyleSheet.cssText.
Guess what that adds up to? No CSS for you, Sir - the whole Y!Mail beta turns into an ugly, unstyled mess where no buttons or options are where they are meant to be. (Since this update is still being rolled out, you may not see it on your account yet but at least one of our test accounts gets the new code with this problem.)

If you'll excuse a bit of screaming..

I just hate this "there are only two browsers" mindset.

This sort of quick and lazy assumptions cause the worst compatibility problems across the web. And just look how incredibly simple it is to do it in a better way:

if ( typeof document.styleSheets[0].cssText != 'undefined' ){
    document.styleSheets[0].cssText = cssContents;
} else {
    var cssTag = document.getElementById('css_place_holder');
    cssTag.innerHTML = cssContents;
}

So what part of "avoid browser sniffing" do the Y!Mail developers not understand?

The insanity of the teacher guilty in Norwich porn case news is beyond belief. One can make lots of obvious observations about the importance of browser security based on this enormous injustice. But let it also be a lesson to us that the law and the society in general still has a very shallow understanding of computers and the web.. The smallest details of browser UI (like when :visited styling is applied) can be misunderstood and have grave consequences. Is it possible to make a UI that can not be misunderstood even in the court room?

The Surfin' Safari blog writes:

We strongly recommend looking for the AppleWebKit string and its version number, *not* for Safari

Apple's Safari FAQ writes:

If you need to identify the exact browser and version of clients accessing your site, use the AppleWebKit/XX portion of the string.

And lib.js on apple.com says:

this.isSafari= (agent.indexOf('safari') != -1);

Makes you wish browser vendors had tried suing browser sniffer authors back in 1996, rather than adding elaborate workaround strings to their UserAgent information. Seriously, authors should try a lot harder to not use name sniffing.