(new function () {
  return function (self) {
    // your code here
  };
})(this);

This is almost like self executing, self destructive code. sweet!

If we can change the code to;

alert = (function(){
    var old_alert = alert;
    return function(m){
        // logging goes here
        old_alert(m);
    }
})();

then by-passing would be a little harder. This is creating private members thru closures.

Always good to have logs, even if they are false you can learn from them.

a) It places IDS logic into the web page, thereby giving it to the attacker
b) It puts you in a position where an attacker can easily clog your IDS with false positives
c) It won’t work if referers are turned off

Sure, in regards to (b), you could collect more data, but you still need some way to verify it - you might be able to automate this by getting some machine to visit the pages in the referer (or passed to your logged as a GET parameter), but that’s just ugly (and seems like a wide open security hole), and it also tells you nothing about POST XSS’s, and so unless you want to discount all the POST XSS’s this detects, you would have to investigate every referer you get with no parameters (or parameters for which your page uses POST data).

So while it might work, it will probably give people a false sense of security, and be a headache to administer if anyone malicious notices it.

ascii, in cases like this, I use the “enlarge textareas” bookmarklet. Make a bookmark with this as the URL, then click it anytime you are on a page with a too small text box.

javascript:(function(){var i,x; for(i=0;x=document.getElementsByTagName(%22textarea%22)[i];++i) x.cols += 150; })()

ps:I know my english is poor…

alert=old_alert;alert("test");

but i know you didn’t intended this as a silver bullet, more like a kiddie protection. wisec has published some info on how to block the fetch/set of a cookie value for geko based browsers, it’s more generic than trap alert()

http://www.wisec.it/sectou.php?id=44c7949f6de03

it can be bypassed too using frames and other techniques (eg: you can try everything but if it’s hooked in js it can also be reverted to the original in js). anyway why not? it’s cheap! i’m going to implement both on my sities

ps: pdp make this textbox larger please : )

Although, a frustrated attacker could add dummy entries to your logs. And since you believe that the log file contains accurate XSSs , you may have hard time removing those false entries.

You may need something more at server side to detect such spamming.