javascriptinternet-explorer-11internet-explorer-10security-policy

IE10 with disabled JS executes manually entered `onmousedown`

In IE10 I've disabled JS execution by setting maximum security level (IE11 also affected).

Then I add or edit onmousedown attribute on any element on any site (for example, body element on www.google.com).

<body onmousedown="alert('Hello')">...</body>

And so I get an alert when clicking anywhere.

Is it expected behavior or bug?

Solution

  • F12 has its own Disable menu in IE10:

    This menu helps you test how users would experience your site based on how they have configured their browser. The following commands are available in the Disable menu:

    Script

    Disable all scripts on a webpage. This command must be clicked again to enable all scripts. When selected, the command is set and causes the page to refresh. This command is not available if Internet Security has Protected Mode set to On. To activate this command, set Protected Mode to Off.

    Popup Blocker

    Disable all pop-up blockers so that pop-ups are allowed on this website. This command must be selected again to enable pop-up blockers. This command is not available if Internet Security has Protected Mode set to On. To activate this command, set Protected Mode to Off.

    All CSS

    Disable all Cascading Style Sheets (CSS) on the page. Click again to enable all CSS. When selected, the command is set and causes the page to refresh to reflect the selection. This command will be re-enabled when a webpage refreshes.

    This is deprecated in IE11:

    There are no plans at this time to bring back the disable menu from IE10 F12. You can disable most of the features previously in the F12 disable menu from the Internet Options advanced and security options.

    References