Firefox and IE's "View source" can be spoofed to show anything • Hacker News Board

Re: Firefox and IE's "View source" can be spoofed to show anything

#41

Post by dave1010uk » Fri, Sep 09, 2011, 6:41 AM UTC

kaitnieks wrote: post #18

Older Internet Explorer and Firefox versions displayed the source that was downloaded, not the one generated/modified by scripts. It makes so much more sense, especially since there was always an option to view the generated source (by using JavaScript for an example) but I don't see how you can access the downloaded source at all if View Source is replaced by View Generated Source. Hm, actually one could use FireBug…

This bug isn't showing the original source or the usual generated source but a hybrid. See my comment here: http://news.ycombinator.com/item?id=2977123

The best way to access downloaded source is probably with JavaScript turned off.

Re: Firefox and IE's "View source" can be spoofed to show anything

#42

Post by nightpool » Fri, Sep 09, 2011, 1:58 PM UTC

HNatWORK wrote: post #12

I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests). Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk. Type the following into the Chrome Dev Tools console, then the Firebug console: testBool = true; document.write(''); typeof testBool; Chrome shows…

The Firefox plugin Web Developer let's you set an option (View source in tab) that makes it work like the Chrome view source.

Re: Firefox and IE's "View source" can be spoofed to show anything

#43

Post by dspillett » Fri, Sep 09, 2011, 4:03 PM UTC

51Cards wrote: post #13

Tried in Firefox 6... spoof works. Tried in Firefox 3.6... could see full source, script and all.

IIRC earlier versions of FF re-request the page when you do a view source, rather than displaying a rendering of the current (potentially changed) document state. You could still spoof the source view in this case by somehow recognising the second request (though how you'd distinguish "view source" from "f5" I don't know) and sending different content back.