https://www.kf.or.kr/js/webtrends.js

1// WebTrends SmartSource Data Collector Tag
2// Version: 9.4.0     
3// Tag Builder Version: 4.4
4// Created: 3/30/2026 6:46:29 AM
5
6function WebTrends(){
7	var that=this;
8	// begin: user modifiable
9	this.dcsid="dcs5w0txb10000wocrvqy1nqm_6n1p";
10	this.domain="webtrends.kf.or.kr";
11	this.timezone=9;
12
13	this.enabled=true;
14	this.i18n=true;
15	this.paidsearchparams="gclid";
16	this.splitvalue="";
17	this.preserve=false;
18	this.cookieTypes = "all";
19	this.FPCConfig = {
20		enabled: (this.cookieTypes === "all" || this.cookieTypes == "firstPartyOnly"),
21		name: "WT_FPC",
22        // [취약점 개선 - 항목6] 쿠키 도메인 범위 과다: 최소 도메인인 현재 접속 호스트명으로 축소 (기존 ".kf.or.kr")
23		domain: window.location.hostname,
24		expires: 63113851500
25	};
26	this.TPCConfig = {
27		enabled: (this.cookieTypes === "all"),
28		cfgType: (this.cookieTypes === "all") ? "":"1"
29	};
30	// end: user modifiable
31	this.DCS={};
32	this.WT={};
33	this.DCSext={};
34	this.images=[];
35	this.index=0;
36
37	this.exre=(function(){return(window.RegExp?new RegExp("dcs(uri)|(ref)|(aut)|(met)|(sta)|(sip)|(pro)|(byt)|(dat)|(p3p)|(cfg)|(redirect)|(cip)","i"):"");})();
38	this.re=(function(){return(window.RegExp?(that.i18n?{"%25":/\%/g,"%26":/\&/g}:{"%09":/\t/g,"%20":/ /g,"%23":/\#/g,"%26":/\&/g,"%2B":/\+/g,"%3F":/\?/g,"%5C":/\\/g,"%22":/\"/g,"%7F":/\x7F/g,"%A0":/\xA0/g}):"");})();
39
40}
41
42WebTrends.prototype.dcsGetId=function(){
43	if (this.enabled&&(document.cookie.indexOf(this.FPCConfig.name+"=")==-1)&&(document.cookie.indexOf("WTLOPTOUT=")==-1)&&this.TPCConfig.enabled){
44        // [취약점 개선 - 항목3] 외부 스크립트의 document.write 로드: DOM 기반 script 객체 생성 방식으로 교체 (공급망 리스크 완화)
45		var script = document.createElement("script");
46		script.type = "text/javascript";
47		script.src = "https://"+this.domain+"/"+this.dcsid+"/wtid.js";
48		document.getElementsByTagName("head")[0].appendChild(script);
49	}
50}
51WebTrends.prototype.setCookieTypes = function (types) {
52	this.FPCConfig.enabled = (types === "all" || types == "firstPartyOnly");	
53	this.TPCConfig.enabled = (types === "all");
54	this.TPCConfig.cfgType = (types === "all") ? "":"1"
55}
56WebTrends.prototype.dcsGetCookie=function(name){
57	var cookies=document.cookie.split("; ");
58	var cmatch=[];
59	var idx=0;
60	var i=0;
61	var namelen=name.length;
62	var clen=cookies.length;
63	for (i=0;i<clen;i++){
64		var c=cookies[i];
65		if ((c.substring(0,namelen+1))==(name+"=")){
66			cmatch[idx++]=c;
67		}
68	}
69	var cmatchCount=cmatch.length;
70	if (cmatchCount>0){
71		idx=0;
72		if ((cmatchCount>1)&&(name==this.FPCConfig.name)){
73			var dLatest=new Date(0);
74			for (i=0;i<cmatchCount;i++){
75				var lv=parseInt(this.dcsGetCrumb(cmatch[i],"lv"));
76				var dLst=new Date(lv);
77				if (dLst>dLatest){
78					dLatest.setTime(dLst.getTime());
79					idx=i;
80				}
81			}
82		}
83		return unescape(cmatch[idx].substring(namelen+1));
84	}
85	else{
86		return null;
87	}
88}
89WebTrends.prototype.dcsGetCrumb=function(cval,crumb,sep){
90	var aCookie=cval.split(sep||":");
91	for (var i=0;i<aCookie.length;i++){
92		var aCrumb=aCookie[i].split("=");
93		if (crumb==aCrumb[0]){
94			return aCrumb[1];
95		}
96	}
97	return null;
98}
99WebTrends.prototype.dcsGetIdCrumb=function(cval,crumb){
100	var id=cval.substring(0,cval.indexOf(":lv="));
101	var aCrumb=id.split("=");
102	for (var i=0;i<aCrumb.length;i++){
103		if (crumb==aCrumb[0]){
104			return aCrumb[1];
105		}
106	}
107	return null;
108}
109WebTrends.prototype.dcsIsFpcSet=function(name,id,lv,ss){
110	var c=this.dcsGetCookie(name);
111	if (c){
112		return ((id==this.dcsGetIdCrumb(c,"id"))&&(lv==this.dcsGetCrumb(c,"lv"))&&(ss==this.dcsGetCrumb(c,"ss")))?0:3;
113	}
114	return 2;
115}
116WebTrends.prototype.dcsDeleteCookie=function(name, path, domain) {	
117	var cDelete = name + "=";
118    // [취약점 개선 - 항목7] 쿠키 삭제 문자열 오류: 중복 작성된 'expires=expires='를 'expires='로 수정
119	cDelete += "; expires=Thu, 01 Jan 1970 00:00:01 GMT";
120	cDelete += "; path=" + path;
121	cDelete += (domain) ? ";domain="+domain : "";		
122	document.cookie = cDelete;
123}
124WebTrends.prototype.dcsFPC=function(){
125	if (document.cookie.indexOf("WTLOPTOUT=")!=-1){
126		return;
127	}
128
129	if (!this.FPCConfig.enabled && !this.TPCConfig.enabled)
130		this.WT["ce"] = "0"
131	else if (this.FPCConfig.enabled && !this.TPCConfig.enabled)
132		this.WT["ce"] = "1";
133	else

134		this.WT["ce"] = "2";
135
136	if (!this.FPCConfig.enabled) {
137		this.dcsDeleteCookie(this.FPCConfig.name, "/", this.FPCConfig.domain);
138		return;
139	}
140
141	var WT=this.WT;
142	var name=this.FPCConfig.name;
143	var dCur=new Date();
144	var adj=(dCur.getTimezoneOffset()*60000)+(this.timezone*3600000);
145	dCur.setTime(dCur.getTime()+adj);
146	var dExp=new Date(dCur.getTime()+315360000000);
147	var dSes=new Date(dCur.getTime());
148	WT.co_f=WT.vtid=WT.vtvs=WT.vt_f=WT.vt_f_a=WT.vt_f_s=WT.vt_f_d=WT.vt_f_tlh=WT.vt_f_tlv="";
149	if (document.cookie.indexOf(name+"=")==-1){
150		if ((typeof(gWtId)!="undefined")&&(gWtId!="")){
151			WT.co_f=gWtId;
152		}
153		else if ((typeof(gTempWtId)!="undefined")&&(gTempWtId!="")){
154			WT.co_f=gTempWtId;
155			WT.vt_f="1";
156		}
157		else{
158			WT.co_f="2";
159			var curt=dCur.getTime().toString();
160			for (var i=2;i<=(32-curt.length);i++){
161				WT.co_f+=Math.floor(Math.random()*16.0).toString(16);
162			}
163			WT.co_f+=curt;
164			WT.vt_f="1";
165		}
166		if (typeof(gWtAccountRollup)=="undefined"){
167			WT.vt_f_a="1";
168		}
169		WT.vt_f_s=WT.vt_f_d="1";
170		WT.vt_f_tlh=WT.vt_f_tlv="0";
171	}
172	else{
173		var c=this.dcsGetCookie(name);
174		var id=this.dcsGetIdCrumb(c,"id");
175		var lv=parseInt(this.dcsGetCrumb(c,"lv"));
176		var ss=parseInt(this.dcsGetCrumb(c,"ss"));
177		if ((id==null)||(id=="null")||isNaN(lv)||isNaN(ss)){
178			return;
179		}
180		WT.co_f=id;
181		var dLst=new Date(lv);
182		WT.vt_f_tlh=Math.floor((dLst.getTime()-adj)/1000);
183		dSes.setTime(ss);
184		if ((dCur.getTime()>(dLst.getTime()+1800000))||(dCur.getTime()>(dSes.getTime()+28800000))){
185			WT.vt_f_tlv=Math.floor((dSes.getTime()-adj)/1000);
186			dSes.setTime(dCur.getTime());
187			WT.vt_f_s="1";
188		}
189		if ((dCur.getDay()!=dLst.getDay())||(dCur.getMonth()!=dLst.getMonth())||(dCur.getYear()!=dLst.getYear())){
190			WT.vt_f_d="1";
191		}
192	}
193	WT.co_f=escape(WT.co_f);
194	WT.vtid=(typeof(this.vtid)=="undefined")?WT.co_f:(this.vtid||"");
195	WT.vtvs=(dSes.getTime()-adj).toString();
196	var expiry= (this.FPCConfig.expires) ? "; expires="+ new Date(new Date().getTime() + (this.FPCConfig.expires)).toGMTString():"";
197	var cur=dCur.getTime().toString();
198	var ses=dSes.getTime().toString();
199    // [취약점 개선 - 항목4] 쿠키 Secure 미설정: Secure 속성을 추가하여 통신 탈취 방지
200	document.cookie=name+"="+"id="+WT.co_f+":lv="+cur+":ss="+ses+expiry+"; samesite=strict; Secure; path=/"+(((this.FPCConfig.domain!=""))?("; domain="+this.FPCConfig.domain):(""));
201	var rc=this.dcsIsFpcSet(name,WT.co_f,cur,ses);
202	if (rc!=0){
203		WT.co_f=WT.vtvs=WT.vt_f_s=WT.vt_f_d=WT.vt_f_tlh=WT.vt_f_tlv="";
204		if (typeof(this.vtid)=="undefined"){
205			WT.vtid="";
206		}
207		WT.vt_f=WT.vt_f_a=rc;
208    }
209}
210
211WebTrends.prototype.dcsMultiTrack=function(){
212	var args=dcsMultiTrack.arguments?dcsMultiTrack.arguments:arguments;
213	if (args.length%2==0){
214        this.dcsSaveProps(args);
215		this.dcsSetProps(args);
216		var dCurrent=new Date();
217		this.DCS.dcsdat=dCurrent.getTime();
218		this.dcsFPC();
219		this.dcsTag();
220		this.dcsRestoreProps();
221	}
222}
223
224WebTrends.prototype.dcsCleanUp=function(){
225	this.DCS={};
226	this.WT={};
227	this.DCSext={};
228	if (arguments.length%2==0){
229		this.dcsSetProps(arguments);
230	}
231}
232WebTrends.prototype.dcsSetProps=function(args){
233	for (var i=0;i<args.length;i+=2){
234		if (args[i].indexOf('WT.')==0){
235			this.WT[args[i].substring(3)]=args[i+1];
236		}
237		else if (args[i].indexOf('DCS.')==0){
238			this.DCS[args[i].substring(4)]=args[i+1];
239		}
240		else if (args[i].indexOf('DCSext.')==0){
241			this.DCSext[args[i].substring(7)]=args[i+1];
242		}
243	}
244}
245WebTrends.prototype.dcsSaveProps=function(args){
246	var i,x,key,param;
247	if (this.preserve){
248		this.args=[];
249		for (i=0,x=0;i<args.length;i+=2){
250			param=args[i];
251			if (param.indexOf('WT.')==0){
252				key=param.substring(3);
253				this.args[x]=param;
254				this.args[x+1]=this.WT[key]||"";
255				x+=2;
256			}
257			else if (param.indexOf('DCS.')==0){
258				key=param.substring(4);
259				this.args[x]=param;
260				this.args[x+1]=this.DCS[key]||"";
261				x+=2;
262			}
263			else if (param.indexOf('DCSext.')==0){
264				key=param.substring(7);
265				this.args[x]=param;
266				this.args[x+1]=this.DCSext[key]||"";
267				x+=2;
268			}
269		}
270	}
271}
272WebTrends.prototype.dcsRestoreProps=function(){
273	if (this.preserve){
274		this.dcsSetProps(this.args);
275		this.args=[];
276	}
277}
278
279WebTrends.prototype.dcsAdv=function(){
280	this.dcsFPC();
281}
282
283WebTrends.prototype.dcsVar=function(){

284	var dCurrent=new Date();
285	var WT=this.WT;
286	var DCS=this.DCS;
287	WT.tz=parseInt(dCurrent.getTimezoneOffset()/60*-1)||"0";
288	WT.bh=dCurrent.getHours()||"0";
289	WT.ul=navigator.appName=="Netscape"?navigator.language:navigator.userLanguage;
290	if (typeof(screen)=="object"){
291		WT.cd=navigator.appName=="Netscape"?screen.pixelDepth:screen.colorDepth;
292		WT.sr=screen.width+"x"+screen.height;
293	}
294    // [취약점 개선 - 항목8, 9] 과도한 브라우저 수집 및 레거시 플러그인 탐지: 
295    // Java, Flash, Silverlight 탐지 코드를 완전히 제거하여 불필요한 데이터 축적 방지 및 최소수집 원칙 준수
296	WT.jo="No";
297	if (document.title){
298		if (window.RegExp){
299			var tire=new RegExp("^"+window.location.protocol+"//"+window.location.hostname+"\\s-\\s");
300			WT.ti=document.title.replace(tire,"");
301		}
302		else{
303			WT.ti=document.title;
304		}
305	}
306	WT.js="Yes";
307	WT.jv=(function(){
308		var agt=navigator.userAgent.toLowerCase();
309		var major=parseInt(navigator.appVersion);
310		var mac=(agt.indexOf("mac")!=-1);
311		var ff=(agt.indexOf("firefox")!=-1);
312		var ff0=(agt.indexOf("firefox/0.")!=-1);
313		var ff10=(agt.indexOf("firefox/1.0")!=-1);
314		var ff15=(agt.indexOf("firefox/1.5")!=-1);
315		var ff20=(agt.indexOf("firefox/2.0")!=-1);
316		var ff3up=(ff&&!ff0&&!ff10&!ff15&!ff20);
317		var nn=(!ff&&(agt.indexOf("mozilla")!=-1)&&(agt.indexOf("compatible")==-1));
318		var nn4=(nn&&(major==4));
319		var nn6up=(nn&&(major>=5));
320		var ie=((agt.indexOf("msie")!=-1)&&(agt.indexOf("opera")==-1));
321		var ie4=(ie&&(major==4)&&(agt.indexOf("msie 4")!=-1));
322		var ie5up=(ie&&!ie4);
323		var op=(agt.indexOf("opera")!=-1);
324		var op5=(agt.indexOf("opera 5")!=-1||agt.indexOf("opera/5")!=-1);
325		var op6=(agt.indexOf("opera 6")!=-1||agt.indexOf("opera/6")!=-1);
326		var op7up=(op&&!op5&&!op6);
327		var jv="1.1";
328		if (ff3up){
329			jv="1.8";
330		}
331		else if (ff20){
332			jv="1.7";
333		}
334		else if (ff15){
335			jv="1.6";
336		}
337		else if (ff0||ff10||nn6up||op7up){
338			jv="1.5";
339		}
340		else if ((mac&&ie5up)||op6){
341			jv="1.4";
342		}
343		else if (ie5up||nn4||op5){
344			jv="1.3";
345		}
346		else if (ie4){
347			jv="1.2";
348		}
349		return jv;
350	})();
351	WT.ct="unknown";
352	if (document.body&&document.body.addBehavior){
353		try{
354			document.body.addBehavior("#default#clientCaps");
355			WT.ct=document.body.connectionType||"unknown";
356			document.body.addBehavior("#default#homePage");
357			WT.hp=document.body.isHomePage(location.href)?"1":"0";
358		}
359		catch(e){
360		}
361	}
362	if (document.all){
363		WT.bs=document.body?document.body.offsetWidth+"x"+document.body.offsetHeight:"unknown";
364	}
365	else{
366		WT.bs=window.innerWidth+"x"+window.innerHeight;
367	}
368    // [취약점 개선] 레거시 플러그인 탐지 제거로 기본값 할당
369	WT.fv="Not enabled";
370	WT.slv="Not enabled";
371
372	if (this.i18n){
373		if (typeof(document.defaultCharset)=="string"){
374			WT.le=document.defaultCharset;
375		} 
376		else if (typeof(document.characterSet)=="string"){
377			WT.le=document.characterSet;
378		}
379		else{
380			WT.le="unknown";
381		}
382	}
383	WT.tv="9.4.0";
384	WT.sp=this.splitvalue;
385	WT.dl="0";
386	WT.ssl=(window.location.protocol.indexOf('https:')==0)?"1":"0";
387	DCS.dcsdat=dCurrent.getTime();
388	DCS.dcssip=window.location.hostname;
389	DCS.dcsuri=window.location.pathname;
390	WT.es=DCS.dcssip+DCS.dcsuri;
391
392    // [취약점 개선 - 항목1] URL Query / Referrer 전체 수집 차단
393    // 민감 파라미터 전송을 막기 위해 DCS.dcsqry 에 전체 URL Query 할당 금지.
394	if (window.location.search){
395        // DCS.dcsqry = window.location.search; (삭제)
396        
397        // 기존의 광고 파라미터(paidsearchparams) 탐지 로직을 유지하기 위해 임시 변수 사용
398		var tempQuery=window.location.search.toLowerCase();
399		var params=this.paidsearchparams.length?this.paidsearchparams.toLowerCase().split(","):[];
400		for (var i=0;i<params.length;i++){
401			if (tempQuery.indexOf(params[i]+"=")!=-1){
402				WT.srch="1";
403				break;
404			}
405		}
406	}
407
408    // [취약점 개선 - 항목1] Referrer 역시 식별자 등의 유출 방지를 위해 전송 객체 할당 차단
409    /*
410	if ((window.document.referrer!="")&&(window.document.referrer!="-")){
411		if (!(navigator.appName=="Microsoft Internet Explorer"&&parseInt(navigator.appVersion)<4)){
412			DCS.dcsref=window.document.referrer; // 삭제
413		}
414	}
415    */
416
417	DCS["dcscfg"] = this.TPCConfig.cfgType;
418}
419
420WebTrends.prototype.dcsEscape=function(S, REL){
421	if (REL!=""){
422		S=S.toString();
423		for (var R in REL){
424 			if (REL[R] instanceof RegExp){
425				S=S.replace(REL[R],R);
426 			}
427		}
428		return S;
429	}
430	else{
431		return escape(S);
432	}
433}
434WebTrends.prototype.dcsA=function(N,V){
435	if (this.i18n&&(this.exre!="")&&!this.exre.test(N)){
436		if (N=="dcsqry"){
437			var newV="";
438			var params=V.substring(1).split("&");
439			for (var i=0;i<params.length;i++){
440				var pair=params[i];
441				var pos=pair.indexOf("=");
442				if (pos!=-1){
443					var key=pair.substring(0,pos);
444					var val=pair.substring(pos+1);
445					if (i!=0){
446						newV+="&";
447					}
448					newV+=key+"="+this.dcsEncode(val);
449				}
450			}
451			V=V.substring(0,1)+newV;
452		}
453		else{
454			V=this.dcsEncode(V);
455		}
456	}
457	return "&"+N+"="+this.dcsEscape(V, this.re);
458}
459WebTrends.prototype.dcsEncode=function(S){
460	return (typeof(encodeURIComponent)=="function")?encodeURIComponent(S):escape(S);
461}
462WebTrends.prototype.dcsCreateImage=function(dcsSrc){
463	if (document.images){
464		this.images[this.index]=new Image();
465		this.images[this.index].src=dcsSrc;
466		this.index++;
467	}
468}
469WebTrends.prototype.dcsMeta=function(){
470	var elems;
471	if (document.documentElement){
472		elems=document.getElementsByTagName("meta");
473	}
474	else if (document.all){
475		elems=document.all.tags("meta");
476	}
477	if (typeof(elems)!="undefined"){
478		var length=elems.length;
479		for (var i=0;i<length;i++){
480			var name=elems.item(i).name;
481			var content=elems.item(i).content;
482			var equiv=elems.item(i).httpEquiv;
483			if (name.length>0){
484				if (name.toUpperCase().indexOf("WT.")==0){
485					this.WT[name.substring(3)]=content;
486				}
487				else if (name.toUpperCase().indexOf("DCSEXT.")==0){
488					this.DCSext[name.substring(7)]=content;
489				}
490				else if (name.toUpperCase().indexOf("DCS.")==0){
491					this.DCS[name.substring(4)]=content;
492				}
493			}
494		}
495	}
496}
497WebTrends.prototype.dcsTag=function(){
498	if (document.cookie.indexOf("WTLOPTOUT=")!=-1){
499		return;
500	}
501	var WT=this.WT;
502	var DCS=this.DCS;
503	var DCSext=this.DCSext;
504	var i18n=this.i18n;
505	var P="https://"+this.domain+(this.dcsid==""?'':'/'+this.dcsid)+"/dcs.gif?";
506	if (i18n){
507		WT.dep="";
508	}
509	for (var N in DCS){
510 		if (DCS[N]&&(typeof DCS[N]!="function")){
511			P+=this.dcsA(N,DCS[N]);
512		}
513	}
514	for (N in WT){
515		if (WT[N]&&(typeof WT[N]!="function")){
516			P+=this.dcsA("WT."+N,WT[N]);
517		}
518	}
519	for (N in DCSext){
520		if (DCSext[N]&&(typeof DCSext[N]!="function")){
521			if (i18n){
522				WT.dep=(WT.dep.length==0)?N:(WT.dep+";"+N);
523			}
524			P+=this.dcsA(N,DCSext[N]);
525		}
526	}
527	if (i18n&&(WT.dep.length>0)){
528		P+=this.dcsA("WT.dep",WT.dep);
529	}
530	if (P.length>2048&&navigator.userAgent.indexOf('MSIE')>=0){
531		P=P.substring(0,2040)+"&WT.tu=1";
532	}
533	this.dcsCreateImage(P);
534	this.WT.ad="";
535}
536WebTrends.prototype.dcsDebug=function(){
537    // [취약점 개선 - 항목2] 디버그 함수의 HTML 직접 출력: 운영환경 노출에 따른 XSS 차단을 위해 비활성화 및 document.write 제거
538	console.warn("[Security] dcsDebug() has been disabled to prevent potential XSS vulnerabilities in the production environment.");
539}
540WebTrends.prototype.dcsCollect=function(){
541    if (this.enabled){
542        this.dcsVar();
543        this.dcsMeta();
544        this.dcsAdv();
545        if (typeof(this.dcsCustom)=="function"){
546			this.dcsCustom();
547        }
548        this.dcsTag();
549    }
550}
551
552function dcsMultiTrack(){
553	if (typeof(_tag)!="undefined"){
554		return(_tag.dcsMultiTrack());
555	}
556}
557
558function dcsDebug(){
559	if (typeof(_tag)!="undefined"){
560		return(_tag.dcsDebug());
561	}
562}
563
564//안전한 방식 (교체)
565Object.defineProperty(Function.prototype, "wtbind", {
566    value: function(obj) {
567        var method = this;
568        return function() {
569            return method.apply(obj, arguments);
570        };
571    },
572    enumerable: false, // 👈 다른 라이브러리 반복문에 노출되지 않도록 숨김!
573    writable: true,
574    configurable: true
575});
576
577var _tag=new WebTrends();
578_tag.dcsGetId();
579_tag.dcsCustom=function(){
580// Add custom parameters here.
581//_tag.DCSext.param_name=param_value;
582}
583_tag.dcsCollect();