TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Firefox and IE's "View source" can be spoofed to show anything

85 pointsby dave1010ukover 13 years ago

11 comments

HNatWORKover 13 years ago
I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests).<p>Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk.<p>Type the following into the Chrome Dev Tools console, then the Firebug console:<p><pre><code> testBool = true; document.write(''); typeof testBool; </code></pre> Chrome shows boolean, firefox shows undefined.
评论 #2975635 未加载
评论 #2975472 未加载
评论 #2976301 未加载
评论 #2978091 未加载
评论 #2976747 未加载
xorglorbover 13 years ago
Since the site seems to be down, you can read the article (no images unfortunately) in Google's Cache[1].<p>[1]: <a href="https://webcache.googleusercontent.com/search?q=cache:http://www.scriptjunkie.us/2011/09/original-source-forgery/&#38;hl=en&#38;strip=1" rel="nofollow">https://webcache.googleusercontent.com/search?q=cache:http:/...</a>
评论 #2974889 未加载
code_duckover 13 years ago
Thankfully, curl can't be tricked in such a manner.<p>I'd have a more substantial comment, I hope, if the site was loading.
评论 #2975828 未加载
评论 #2974970 未加载
评论 #2974696 未加载
kaitnieksover 13 years ago
Older Internet Explorer and Firefox versions displayed the source that was downloaded, not the one generated/modified by scripts. It makes so much more sense, especially since there was always an option to view the generated source (by using JavaScript for an example) but I don't see how you can access the downloaded source at all if View Source is replaced by View Generated Source. Hm, actually one could use FireBug and watch Net response I suppose, but that's inconvenient.
评论 #2977134 未加载
评论 #2975336 未加载
jannesover 13 years ago
Hmm, I can't reproduce what he claims by only looking at the cached version without images and source code.<p>I especially don't understand this part:<p><pre><code> When you use document.write outside of a script tag embedded inline in the page [...] </code></pre> What is "outside of a script tag embedded inline in the page" supposed to mean?
评论 #2974935 未加载
AndyKelleyover 13 years ago
In my opinion, "View source" should be a text log of everything the server sent to the client. Why would you ever want anything different?
Flamover 13 years ago
One of the many reasons why I recommend using NoScript. <a href="http://noscript.net/" rel="nofollow">http://noscript.net/</a>
评论 #2977063 未加载
评论 #2976919 未加载
Kudosover 13 years ago
What's with the out of date Flash popup? Running Chrome beta channel here with Flash built in.
评论 #2974527 未加载
xyzzyzover 13 years ago
Opera 11.51 won't even try show the source for me. It's definitely interesting.
51Cardsover 13 years ago
Tried in Firefox 6... spoof works. Tried in Firefox 3.6... could see full source, script and all.
评论 #2978605 未加载
Kwpolskaover 13 years ago
Actually, chrome downloads the source again when you choose "view source". You can see the "modded" source with ctrl/cmd+shift+I.
评论 #2975108 未加载