Firefox and IE's "View source" can be spoofed to show anything

by dave1010uk on 9/8/2011, 3:59 PM with 40 comments
  • by HNatWORK on 9/8/2011, 6:30 PM

    I believe Chrome shows the original source because when you View Source, it requests the page again. This complicates debugging Ajax requests (and also Get and Post requests).

    Firefox and IE show the "current" source, which is liable to be replaced as shown by dave1010uk.

    Type the following into the Chrome Dev Tools console, then the Firebug console:

      testBool = true;
  document.write('');
  typeof testBool;
    Chrome shows boolean, firefox shows undefined.

  • by xorglorb on 9/8/2011, 5:20 PM

    Since the site seems to be down, you can read the article (no images unfortunately) in Google's Cache[1].

    [1]: https://webcache.googleusercontent.com/search?q=cache:http:/...

  • by code_duck on 9/8/2011, 4:41 PM

    Thankfully, curl can't be tricked in such a manner.

    I'd have a more substantial comment, I hope, if the site was loading.

  • by kaitnieks on 9/8/2011, 7:35 PM

    Older Internet Explorer and Firefox versions displayed the source that was downloaded, not the one generated/modified by scripts. It makes so much more sense, especially since there was always an option to view the generated source (by using JavaScript for an example) but I don't see how you can access the downloaded source at all if View Source is replaced by View Generated Source. Hm, actually one could use FireBug and watch Net response I suppose, but that's inconvenient.

  • by jannes on 9/8/2011, 5:54 PM

    Hmm, I can't reproduce what he claims by only looking at the cached version without images and source code.

    I especially don't understand this part:

      When you use document.write outside of a script tag embedded inline in
  the page [...]
    What is "outside of a script tag embedded inline in the page" supposed to mean?

  • by AndyKelley on 9/9/2011, 6:01 AM

    In my opinion, "View source" should be a text log of everything the server sent to the client. Why would you ever want anything different?

  • by Flam on 9/8/2011, 11:19 PM

    One of the many reasons why I recommend using NoScript. http://noscript.net/

  • by Kudos on 9/8/2011, 4:12 PM

    What's with the out of date Flash popup? Running Chrome beta channel here with Flash built in.

  • by xyzzyz on 9/8/2011, 9:42 PM

    Opera 11.51 won't even try show the source for me. It's definitely interesting.

  • by 51Cards on 9/8/2011, 6:31 PM

    Tried in Firefox 6... spoof works. Tried in Firefox 3.6... could see full source, script and all.

  • by Kwpolska on 9/8/2011, 6:32 PM

    Actually, chrome downloads the source again when you choose "view source". You can see the "modded" source with ctrl/cmd+shift+I.