Block specific HTML file (Eaglercraft)

[Undertoad]

Hi

 

Apologies if this is in the wrong place. Recently we've found that students have been accessing a Minecraft port called Eaglercraft (https://eaglercaft.com), we've blocked all links to it online but have found out that all the students need is a HTML file downloaded from the site to be able run the entire thing in a browser offline.

 

Does anyone have any idea how we could go about blocking this file?

 

My go-to was Applocker but as this file isn't technically an executable file Applocker doesn't detect it and so we can't block its hash.

 

Thanks in advance

[mavhc]

Block browser tabs with the name "Eaglercraft*"

[Undertoad]

How would you go about this? I can block Edge urls with a group policy but I'm not to sure how I would go about blocking based on tab name.

[3s-gtech]

Have you got one of these html files to examine?

[dmj]

Back in the day we used to block flash .swf files from saving onto the users home areas. In this case I would wager that the html file is probably loading a js file from a cdn somewhere. If you inspect the file you can probably work out the file it's trying to pull and block it there.

[mavhc]

How would you go about this? I can block Edge urls with a group policy but I'm not to sure how I would go about blocking based on tab name.

 

I'd do it with impero, I assume similar programs can do the same

[andy_b]

Have you got one of these html files to examine?

 

It's on the https://eaglercraft.com/ page - offline link

 

I got this link - https://bafybeieswo56iapqi5eojfrp2soxd2umfkiycvy4366dudqjomh57dajgq.ipfs.dweb.link/?filename=EaglercraftX_1.8_Signed_Singleplayer_Offline.zip

 

Back in the day we used to block flash .swf files from saving onto the users home areas. In this case I would wager that the html file is probably loading a js file from a cdn somewhere. If you inspect the file you can probably work out the file it's trying to pull and block it there.

 

It is a 14 MB html file that seems to be able to run completely offline (at least the single player game I tested). It will contact some wss addresses if it has a network connection.

[robyholmes]

We've had to block all local files being opened in Chrome and Edge due to students playing games via downloaded html files.

 

Doing do breaks PDF viewing as well, so we've made Adobe Reader the default viewer.

[Al_Balone]

The entire JS is contained in the of the document, the actual HTML is only a few lines long. Maybe it's worth looking at whether it's possible to block JS running if the file was accessed locally?

[Undertoad]

We've had to block all local files being opened in Chrome and Edge due to students playing games via downloaded html files.

 

Doing do breaks PDF viewing as well, so we've made Adobe Reader the default viewer.

 

The entire JS is contained in the of the document, the actual HTML is only a few lines long. Maybe it's worth looking at whether it's possible to block JS running if the file was accessed locally?

 

I'll look into both of these. I'd rather not have a blanket ban on local files being opened in Edge/Chrome, but if that ends up being to only way to do it, so be it

[Undertoad]

In the end we managed to get around this by blocking JavaScript on the URL "file:///*" and pushing that as a group policy to students. Nothing else has broken yet... Edited March 28, 2024 by Undertoad

[Sephiroth]

We've just had this rear it's head here and I'm struggling to find a way of reliably stopping it without blocking file URLs, which is a last resort.

 

On 28/03/2024 at 14:28, Undertoad said:

In the end we managed to get around this by blocking JavaScript on the URL "file:///*" and pushing that as a group policy to students. Nothing else has broken yet...

 

How did you do this? Hopefully I can get this to work in both Edge and Chrome.

[NegativeKillDeath]

On 08/05/2025 at 11:28, Sephiroth said:

We've just had this rear it's head here and I'm struggling to find a way of reliably stopping it without blocking file URLs, which is a last resort.

 

 

How did you do this? Hopefully I can get this to work in both Edge and Chrome.

 

This GPO Microsoft Edge Browser Policy Documentation | Microsoft Learn and use file:///* as the URL. Can be applied to User or Computer. There is a similar GPO for chrome. 

[kennysarmy]

On 09/05/2025 at 14:36, NegativeKillDeath said:

 

This GPO Microsoft Edge Browser Policy Documentation | Microsoft Learn and use file:///* as the URL. Can be applied to User or Computer. There is a similar GPO for chrome. 

 

Really useful - thanks. 

[paulkerton]

9 hours ago, Mike-Graham said:

Be more flexible with your blocking, anything and anyone can get past this. Although I cannot explain how nor why.

 

This user's timing and behaviour, in no way, seem suspicious. Is it the Epstein image on their background, or their resurrection of 15 year old threads to come on here and lecture everyone?

[synaesthesia]

I was going to ask for a demonstration of concrete growing