javascript - CF-Hash attribute and script mysteriously added to mailto links

Question

I have a development site and production site:

I have a mailto email link at the bottom, the php source code is exactly as follows:

           <section>
               <h2>Looking for a LAMP, WordPress or Drupal Developer?</h2>
               <p>Contact me today: <br/>
                <a href='mailto:mail@example.com'>mail@example.com</a>
                   <br/>
                <a href='tel:+13334445555'>333 444 5555</a>
               </p>
           </section>

Everything is normal on my development site, the produced html is as follows:

                <section>
                    <h2>Looking for a LAMP, WordPress or Drupal Developer?</h2>
                    <p>Contact me today: <br>
                        <a href="mailto:mail@example.com">mail@example.com</a>
                        <br>
                        <a href="tel:+13334445555">333 444 5555</a>
                    </p>
                </section>

Then mysteriously on my production site some javascript is being added my my mailto link (and only mailto links, in this case just the one but I have added more and the script is added to them as well) Here is the html output on the production site:

<section>
<h2>Looking for a LAMP, WordPress or Drupal Developer?</h2>
<p>Contact me today: <br>
<a href="mailto:mail@example.com">mail@example.com
<script cf-hash="f9e31" type="text/javascript">
/* <![CDATA[ */!function(){try{var t="currentScript"in document?document.currentScript:function()        {for(var t=document.getElementsByTagName("script"),e=t.length;e--;)if(t[e].getAttribute("cf-hash"))return t[e]}();if(t&&t.previousSibling){var e,r,n,i,c=t.previousSibling,a=c.getAttribute("data-cfemail");if(a){for(e="",r=parseInt(a.substr(0,2),16),n=2;a.length-n;n+=2)i=parseInt(a.substr(n,2),16)^r,e+=String.fromCharCode(i);e=document.createTextNode(e),c.parentNode.replaceChild(e,c)}}}catch(u){}}();/* ]]> */
</script>
</a>
<br>
<a href="tel:+13334445555">333 444 5555</a>
</p>
</section>

I have checked the code on my production server, this script is not there.

What could possibly be going on?

Answer 1

This isn't related to ColdFusion. In this code, cf-hash is an attribute of a SCRIPT tag (plain HTML). Searching on 'cf-hash="f9e31" gets a lot of similar code out there. Found this link that points to it possibly being a CloudFlare Email Protection script. That would be something running on your production server that's not in your local development environment.