akismet-frontend.js 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376
  1. /**
  2. * Observe how the user enters content into the comment form in order to determine whether it's a bot or not.
  3. *
  4. * Note that no actual input is being saved here, only counts and timings between events.
  5. */
  6. ( function() {
  7. // Passive event listeners are guaranteed to never call e.preventDefault(),
  8. // but they're not supported in all browsers. Use this feature detection
  9. // to determine whether they're available for use.
  10. var supportsPassive = false;
  11. try {
  12. var opts = Object.defineProperty( {}, 'passive', {
  13. get : function() {
  14. supportsPassive = true;
  15. }
  16. } );
  17. window.addEventListener( 'testPassive', null, opts );
  18. window.removeEventListener( 'testPassive', null, opts );
  19. } catch ( e ) {}
  20. function init() {
  21. var input_begin = '';
  22. var keydowns = {};
  23. var lastKeyup = null;
  24. var lastKeydown = null;
  25. var keypresses = [];
  26. var modifierKeys = [];
  27. var correctionKeys = [];
  28. var lastMouseup = null;
  29. var lastMousedown = null;
  30. var mouseclicks = [];
  31. var mousemoveTimer = null;
  32. var lastMousemoveX = null;
  33. var lastMousemoveY = null;
  34. var mousemoveStart = null;
  35. var mousemoves = [];
  36. var touchmoveCountTimer = null;
  37. var touchmoveCount = 0;
  38. var lastTouchEnd = null;
  39. var lastTouchStart = null;
  40. var touchEvents = [];
  41. var scrollCountTimer = null;
  42. var scrollCount = 0;
  43. var correctionKeyCodes = [ 'Backspace', 'Delete', 'ArrowUp', 'ArrowDown', 'ArrowLeft', 'ArrowRight', 'Home', 'End', 'PageUp', 'PageDown' ];
  44. var modifierKeyCodes = [ 'Shift', 'CapsLock' ];
  45. var forms = document.querySelectorAll( 'form[method=post]' );
  46. for ( var i = 0; i < forms.length; i++ ) {
  47. var form = forms[i];
  48. var formAction = form.getAttribute( 'action' );
  49. // Ignore forms that POST directly to other domains; these could be things like payment forms.
  50. if ( formAction ) {
  51. // Check that the form is posting to an external URL, not a path.
  52. if ( formAction.indexOf( 'http://' ) == 0 || formAction.indexOf( 'https://' ) == 0 ) {
  53. if ( formAction.indexOf( 'http://' + window.location.hostname + '/' ) != 0 && formAction.indexOf( 'https://' + window.location.hostname + '/' ) != 0 ) {
  54. continue;
  55. }
  56. }
  57. }
  58. form.addEventListener( 'submit', function () {
  59. var ak_bkp = prepare_timestamp_array_for_request( keypresses );
  60. var ak_bmc = prepare_timestamp_array_for_request( mouseclicks );
  61. var ak_bte = prepare_timestamp_array_for_request( touchEvents );
  62. var ak_bmm = prepare_timestamp_array_for_request( mousemoves );
  63. var input_fields = {
  64. // When did the user begin entering any input?
  65. 'bib': input_begin,
  66. // When was the form submitted?
  67. 'bfs': Date.now(),
  68. // How many keypresses did they make?
  69. 'bkpc': keypresses.length,
  70. // How quickly did they press a sample of keys, and how long between them?
  71. 'bkp': ak_bkp,
  72. // How quickly did they click the mouse, and how long between clicks?
  73. 'bmc': ak_bmc,
  74. // How many mouseclicks did they make?
  75. 'bmcc': mouseclicks.length,
  76. // When did they press modifier keys (like Shift or Capslock)?
  77. 'bmk': modifierKeys.join( ';' ),
  78. // When did they correct themselves? e.g., press Backspace, or use the arrow keys to move the cursor back
  79. 'bck': correctionKeys.join( ';' ),
  80. // How many times did they move the mouse?
  81. 'bmmc': mousemoves.length,
  82. // How many times did they move around using a touchscreen?
  83. 'btmc': touchmoveCount,
  84. // How many times did they scroll?
  85. 'bsc': scrollCount,
  86. // How quickly did they perform touch events, and how long between them?
  87. 'bte': ak_bte,
  88. // How many touch events were there?
  89. 'btec' : touchEvents.length,
  90. // How quickly did they move the mouse, and how long between moves?
  91. 'bmm' : ak_bmm
  92. };
  93. var akismet_field_prefix = 'ak_';
  94. if ( this.getElementsByClassName ) {
  95. // Check to see if we've used an alternate field name prefix. We store this as an attribute of the container around some of the Akismet fields.
  96. var possible_akismet_containers = this.getElementsByClassName( 'akismet-fields-container' );
  97. for ( var containerIndex = 0; containerIndex < possible_akismet_containers.length; containerIndex++ ) {
  98. var container = possible_akismet_containers.item( containerIndex );
  99. if ( container.getAttribute( 'data-prefix' ) ) {
  100. akismet_field_prefix = container.getAttribute( 'data-prefix' );
  101. break;
  102. }
  103. }
  104. }
  105. for ( var field_name in input_fields ) {
  106. var field = document.createElement( 'input' );
  107. field.setAttribute( 'type', 'hidden' );
  108. field.setAttribute( 'name', akismet_field_prefix + field_name );
  109. field.setAttribute( 'value', input_fields[ field_name ] );
  110. this.appendChild( field );
  111. }
  112. }, supportsPassive ? { passive: true } : false );
  113. form.addEventListener( 'keydown', function ( e ) {
  114. // If you hold a key down, some browsers send multiple keydown events in a row.
  115. // Ignore any keydown events for a key that hasn't come back up yet.
  116. if ( e.key in keydowns ) {
  117. return;
  118. }
  119. var keydownTime = ( new Date() ).getTime();
  120. keydowns[ e.key ] = [ keydownTime ];
  121. if ( ! input_begin ) {
  122. input_begin = keydownTime;
  123. }
  124. // In some situations, we don't want to record an interval since the last keypress -- for example,
  125. // on the first keypress, or on a keypress after focus has changed to another element. Normally,
  126. // we want to record the time between the last keyup and this keydown. But if they press a
  127. // key while already pressing a key, we want to record the time between the two keydowns.
  128. var lastKeyEvent = Math.max( lastKeydown, lastKeyup );
  129. if ( lastKeyEvent ) {
  130. keydowns[ e.key ].push( keydownTime - lastKeyEvent );
  131. }
  132. lastKeydown = keydownTime;
  133. }, supportsPassive ? { passive: true } : false );
  134. form.addEventListener( 'keyup', function ( e ) {
  135. if ( ! ( e.key in keydowns ) ) {
  136. // This key was pressed before this script was loaded, or a mouseclick happened during the keypress, or...
  137. return;
  138. }
  139. var keyupTime = ( new Date() ).getTime();
  140. if ( 'TEXTAREA' === e.target.nodeName || 'INPUT' === e.target.nodeName ) {
  141. if ( -1 !== modifierKeyCodes.indexOf( e.key ) ) {
  142. modifierKeys.push( keypresses.length - 1 );
  143. } else if ( -1 !== correctionKeyCodes.indexOf( e.key ) ) {
  144. correctionKeys.push( keypresses.length - 1 );
  145. } else {
  146. // ^ Don't record timings for keys like Shift or backspace, since they
  147. // typically get held down for longer than regular typing.
  148. var keydownTime = keydowns[ e.key ][0];
  149. var keypress = [];
  150. // Keypress duration.
  151. keypress.push( keyupTime - keydownTime );
  152. // Amount of time between this keypress and the previous keypress.
  153. if ( keydowns[ e.key ].length > 1 ) {
  154. keypress.push( keydowns[ e.key ][1] );
  155. }
  156. keypresses.push( keypress );
  157. }
  158. }
  159. delete keydowns[ e.key ];
  160. lastKeyup = keyupTime;
  161. }, supportsPassive ? { passive: true } : false );
  162. form.addEventListener( "focusin", function ( e ) {
  163. lastKeydown = null;
  164. lastKeyup = null;
  165. keydowns = {};
  166. }, supportsPassive ? { passive: true } : false );
  167. form.addEventListener( "focusout", function ( e ) {
  168. lastKeydown = null;
  169. lastKeyup = null;
  170. keydowns = {};
  171. }, supportsPassive ? { passive: true } : false );
  172. }
  173. document.addEventListener( 'mousedown', function ( e ) {
  174. lastMousedown = ( new Date() ).getTime();
  175. }, supportsPassive ? { passive: true } : false );
  176. document.addEventListener( 'mouseup', function ( e ) {
  177. if ( ! lastMousedown ) {
  178. // If the mousedown happened before this script was loaded, but the mouseup happened after...
  179. return;
  180. }
  181. var now = ( new Date() ).getTime();
  182. var mouseclick = [];
  183. mouseclick.push( now - lastMousedown );
  184. if ( lastMouseup ) {
  185. mouseclick.push( lastMousedown - lastMouseup );
  186. }
  187. mouseclicks.push( mouseclick );
  188. lastMouseup = now;
  189. // If the mouse has been clicked, don't record this time as an interval between keypresses.
  190. lastKeydown = null;
  191. lastKeyup = null;
  192. keydowns = {};
  193. }, supportsPassive ? { passive: true } : false );
  194. document.addEventListener( 'mousemove', function ( e ) {
  195. if ( mousemoveTimer ) {
  196. clearTimeout( mousemoveTimer );
  197. mousemoveTimer = null;
  198. }
  199. else {
  200. mousemoveStart = ( new Date() ).getTime();
  201. lastMousemoveX = e.offsetX;
  202. lastMousemoveY = e.offsetY;
  203. }
  204. mousemoveTimer = setTimeout( function ( theEvent, originalMousemoveStart ) {
  205. var now = ( new Date() ).getTime() - 500; // To account for the timer delay.
  206. var mousemove = [];
  207. mousemove.push( now - originalMousemoveStart );
  208. mousemove.push(
  209. Math.round(
  210. Math.sqrt(
  211. Math.pow( theEvent.offsetX - lastMousemoveX, 2 ) +
  212. Math.pow( theEvent.offsetY - lastMousemoveY, 2 )
  213. )
  214. )
  215. );
  216. if ( mousemove[1] > 0 ) {
  217. // If there was no measurable distance, then it wasn't really a move.
  218. mousemoves.push( mousemove );
  219. }
  220. mousemoveStart = null;
  221. mousemoveTimer = null;
  222. }, 500, e, mousemoveStart );
  223. }, supportsPassive ? { passive: true } : false );
  224. document.addEventListener( 'touchmove', function ( e ) {
  225. if ( touchmoveCountTimer ) {
  226. clearTimeout( touchmoveCountTimer );
  227. }
  228. touchmoveCountTimer = setTimeout( function () {
  229. touchmoveCount++;
  230. }, 500 );
  231. }, supportsPassive ? { passive: true } : false );
  232. document.addEventListener( 'touchstart', function ( e ) {
  233. lastTouchStart = ( new Date() ).getTime();
  234. }, supportsPassive ? { passive: true } : false );
  235. document.addEventListener( 'touchend', function ( e ) {
  236. if ( ! lastTouchStart ) {
  237. // If the touchstart happened before this script was loaded, but the touchend happened after...
  238. return;
  239. }
  240. var now = ( new Date() ).getTime();
  241. var touchEvent = [];
  242. touchEvent.push( now - lastTouchStart );
  243. if ( lastTouchEnd ) {
  244. touchEvent.push( lastTouchStart - lastTouchEnd );
  245. }
  246. touchEvents.push( touchEvent );
  247. lastTouchEnd = now;
  248. // Don't record this time as an interval between keypresses.
  249. lastKeydown = null;
  250. lastKeyup = null;
  251. keydowns = {};
  252. }, supportsPassive ? { passive: true } : false );
  253. document.addEventListener( 'scroll', function ( e ) {
  254. if ( scrollCountTimer ) {
  255. clearTimeout( scrollCountTimer );
  256. }
  257. scrollCountTimer = setTimeout( function () {
  258. scrollCount++;
  259. }, 500 );
  260. }, supportsPassive ? { passive: true } : false );
  261. }
  262. /**
  263. * For the timestamp data that is collected, don't send more than `limit` data points in the request.
  264. * Choose a random slice and send those.
  265. */
  266. function prepare_timestamp_array_for_request( a, limit ) {
  267. if ( ! limit ) {
  268. limit = 100;
  269. }
  270. var rv = '';
  271. if ( a.length > 0 ) {
  272. var random_starting_point = Math.max( 0, Math.floor( Math.random() * a.length - limit ) );
  273. for ( var i = 0; i < limit && i < a.length; i++ ) {
  274. rv += a[ random_starting_point + i ][0];
  275. if ( a[ random_starting_point + i ].length >= 2 ) {
  276. rv += "," + a[ random_starting_point + i ][1];
  277. }
  278. rv += ";";
  279. }
  280. }
  281. return rv;
  282. }
  283. if ( document.readyState !== 'loading' ) {
  284. init();
  285. } else {
  286. document.addEventListener( 'DOMContentLoaded', init );
  287. }
  288. })();