1

On my website, I log client-side errors. Recently, a number of my users have been experiencing the following error:

SyntaxError: Unexpected token var

and the "file" in which this occurs is:

data:application/javascript;base64,dmFyIHVyY2hpblRyYWNrZXI9ZnVuY3Rpb24oKXt9LF9nYXE9e3B1c2g6ZnVuY3Rpb24oKXt0cnkge2lmKGFyZ3VtZW50c1swXVswXT09J19saW5rJyl3aW5kb3cubG9jYXRpb24uaHJlZj1hcmd1bWVudHNbMF1bMV19Y2F0Y2goZXIpe319fSxfZ2F0PXtfY3JlYXRlVHJhY2tlcjpmdW5jdGlvbigpe30sIF9nZXRUcmFja2VyOmZ1bmN0aW9uKCl7cmV0dXJue19fbm9TdWNoTWV0aG9kX186ZnVuY3Rpb24oKXt9LF9saW5rOmZ1bmN0aW9uKG8pe2lmKG8pbG9jYXRpb24uaHJlZj1vO30sX2xpbmtCeVBvc3Q6ZnVuY3Rpb24oKXtyZXR1cm4gdHJ1ZTt9LF9nZXRMaW5rZXJVcmw6ZnVuY3Rpb24obyl7cmV0dXJuIG87fSxfdHJhY2tFdmVudDpmdW5jdGlvbigpe319fX07Y3hBcGk9e3NldENvb2tpZVBhdGg6ZnVuY3Rpb24oKXt9LGNob29zZVZhcmlhdGlvbjpmdW5jdGlvbigpe319dmFyIF9nYXQ9e19nZXRUcmFja2VyQnlOYW1lOiBmdW5jdGlvbigpe190cmFja0V2ZW50OiBmdW5jdGlvbigpe319fTs=

The interesting thing is that I don't use any base-64 encoded scripts at all. If you base64-decode and pretty-print the above blob, you get:

var urchinTracker = function() {},
    _gaq = {
        push: function() {
            try {
                if (arguments[0][0] == '_link') window.location.href = arguments[0][1]
            } catch (er) {}
        }
    },
    _gat = {
        _createTracker: function() {},
        _getTracker: function() {
            return {
                __noSuchMethod__: function() {},
                _link: function(o) {
                    if (o) location.href = o;
                },
                _linkByPost: function() {
                    return true;
                },
                _getLinkerUrl: function(o) {
                    return o;
                },
                _trackEvent: function() {}
            }
        }
    };
cxApi = {
    setCookiePath: function() {},
    chooseVariation: function() {}
}
var _gat = {
    _getTrackerByName: function() {
        _trackEvent: function() {}
    }
};

This looks vaguely like Google Analytics code, and I do indeed use Google Analytics. But I also imagine that this is unlikely to be something Google Analytics is doing itself, because I generally expect Google products not to barf errors.

Has anyone seen this before / know what it is?

  • 2
    Looks like a page hijacking script. The section "window.location.href = arguments[0][1]" will redirect the user somewhere. It may be deliberately designed to look like analytics to confuse/fool people. – Steve Oct 1 '17 at 20:38
  • I think this could be very old Google analytics tracking code since it contains the word urchinTracker which was the first version og GA. They based it on the Urchin tracker. However I can't validate nor cofirm the validity of the code you show us here. But maybe this can point you in the right direction. – Kristian Svensson Oct 4 '17 at 22:53
1

It looks like it's one of the privacy-protecting extensions (Privacy Badger / Ghostery / etc.) injecting it to disable Google Analytics by replacing its methods with stubs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.