6 ms·

What are the implications of this? Can’t you just curl/wget the html?

magicalist 5y ago
Chrome uses a `view-source` scheme to trigger showing the source of a web page. This change allows Chrome Enterprise administrators to add `view-source:*` to their blocklist so Chrome instances governed by an enterprise policy with that enabled (like at a school or company) wouldn't be able to visit those pages and so wouldn't be able to view source in the browser.
- grayfaced 5y ago
  Would also need to block ctrl+s/save. Which seems pretty drastic for anything other then a dedicated testing machine.
  - tyingq 5y ago
    Also pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of: javascript:alert(document.body.innerHTML);
    - birdman3131 5y ago
      You can't actually paste that into the omnibar in chrome. It will eat the first part.
      - tyingq 5y ago
        Yes, you have to manually type "javascript:" then paste the code. Or copy everything but the leading 'j' and hand type that after pasting. Or put it in a bookmark. Also, alert() truncates the text, but makes for a nice short demo. You could append a <pre> element to the page, or similar.
        colejohnson66 5y ago
        Taking advantage of a long-lost HTML tag (<plaintext>) that tells the parser to switch the tokenizer to "PLAINTEXT" state[0] with no escape: javascript:document.body.innerHTML="<plaintext>"+document.body.innerHTML From MDN[1]: > The <plaintext> HTML element renders everything following the start tag as raw text, ignoring any following HTML. There is no closing tag, since everything after it is considered raw text. You could use the <pre> tag, but that can be "escaped" from if a </pre> tag exists on the page. Escaping the angle brackets with < and > would fix it, but <plaintext> is more elegant IMO. [0]: https://html.spec.whatwg.org/#plaintext-state https://html.spec.whatwg.org/#plaintext-state [1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/plaintext https://developer.mozilla.org/en-US/docs/Web/HTML/Element/pl...
        tyingq 5y ago
        Yeah, that works great. Then the kids just put that in a bookmark called "view-source". Probably also easy enough to make another bookmark that puts it back to normal.
missblit 5y ago
This kind of stuff can make sense when you consider "enterprise" environments like school labs. Notice on the bug report that the reproduction steps include setting a "DeveloperToolsDisabled" registry entry. Curl / wget wouldn't always be accessible in this kind of locked down setup (and they're probably trying to make it difficult even if it's impossible to block completely).
- vagrantJin 5y ago
  Doesnt this solution strike you as scorched earth? Kids figure out things, instead of improving said software, lockdown the actual browser? It's nearsighted to the point of disbelief.
  - benjamir 5y ago
    At that level of pay you stop caring for anything making sense? Just saying. Apart from drug addicts doing blunt cybercrimes, I find the most creapy things are done by devs that got used to a big paycheck -- additionally, sometimes got fkd in academia before and just became a well trained cynic.
jamesfinlayson 5y ago
Or look in the network tab too?
- verdverm 5y ago
  You can block devtools as well it looks like
verdverm 5y ago
Seems like they have added the ability to block devtools on sites as well... Certainly seems like we'll need tools which don't close things off like this.
josephcsible 5y ago
On computers that would use this "feature", curl and wget wouldn't be available for use.
selcuka 5y ago
You have to be logged in to Google to use Google Forms. You can emulate a login using curl/wget but it's harder. You could also install another browser if that was allowed.

Chrome uses a `view-source` scheme to trigger showing the source of a web page. This change allows Chrome Enterprise administrators to add `view-source:*` to their blocklist so Chrome instances governed by an enterprise policy with that enabled (like at a school or company) wouldn't be able to visit those pages and so wouldn't be able to view source in the browser.

grayfaced 5y ago
Would also need to block ctrl+s/save. Which seems pretty drastic for anything other then a dedicated testing machine.
- tyingq 5y ago
  Also pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of: javascript:alert(document.body.innerHTML);
  - birdman3131 5y ago
    You can't actually paste that into the omnibar in chrome. It will eat the first part.
    - tyingq 5y ago
      Yes, you have to manually type "javascript:" then paste the code. Or copy everything but the leading 'j' and hand type that after pasting. Or put it in a bookmark. Also, alert() truncates the text, but makes for a nice short demo. You could append a <pre> element to the page, or similar.
      - colejohnson66 5y ago
        Taking advantage of a long-lost HTML tag (<plaintext>) that tells the parser to switch the tokenizer to "PLAINTEXT" state[0] with no escape: javascript:document.body.innerHTML="<plaintext>"+document.body.innerHTML From MDN[1]: > The <plaintext> HTML element renders everything following the start tag as raw text, ignoring any following HTML. There is no closing tag, since everything after it is considered raw text. You could use the <pre> tag, but that can be "escaped" from if a </pre> tag exists on the page. Escaping the angle brackets with < and > would fix it, but <plaintext> is more elegant IMO. [0]: https://html.spec.whatwg.org/#plaintext-state https://html.spec.whatwg.org/#plaintext-state [1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/plaintext https://developer.mozilla.org/en-US/docs/Web/HTML/Element/pl...
        tyingq 5y ago
        Yeah, that works great. Then the kids just put that in a bookmark called "view-source". Probably also easy enough to make another bookmark that puts it back to normal.

missblit 5y ago

This kind of stuff can make sense when you consider "enterprise" environments like school labs. Notice on the bug report that the reproduction steps include setting a "DeveloperToolsDisabled" registry entry. Curl / wget wouldn't always be accessible in this kind of locked down setup (and they're probably trying to make it difficult even if it's impossible to block completely).

vagrantJin 5y ago
Doesnt this solution strike you as scorched earth? Kids figure out things, instead of improving said software, lockdown the actual browser? It's nearsighted to the point of disbelief.
- benjamir 5y ago
  At that level of pay you stop caring for anything making sense? Just saying. Apart from drug addicts doing blunt cybercrimes, I find the most creapy things are done by devs that got used to a big paycheck -- additionally, sometimes got fkd in academia before and just became a well trained cynic.

jamesfinlayson 5y ago

Or look in the network tab too?

verdverm 5y ago
You can block devtools as well it looks like

verdverm 5y ago

Seems like they have added the ability to block devtools on sites as well... Certainly seems like we'll need tools which don't close things off like this.

josephcsible 5y ago

On computers that would use this "feature", curl and wget wouldn't be available for use.

selcuka 5y ago

You have to be logged in to Google to use Google Forms. You can emulate a login using curl/wget but it's harder. You could also install another browser if that was allowed.