4 ms·
> who would ever expect 'view-source' to have a blacklist or be controllable by the web page This is about enterprise policy in a managed environment. It was a
by lima 5y ago
> who would ever expect 'view-source' to have a blacklist or be controllable by the web page
This is about enterprise policy in a managed environment. It was already able to block a URL - like https://google.com https://google.com - but not view-source:https://google.com https://google.com.
Blocking devtools was already possible.
- azeirah 5y agodoes this prevent you from pasting js like this into the URL bar? javascript:let $code=document.createElement('textarea');let source=document.body.outerHTML;$code.innerHTML = source;document.body.appendChild($code); For those who don't feel like reading a js oneliner, it reads the page source and adds an element to the page that displays all of it.
- sbierwagen 5y agoDoes pasting javascript into the URL bar execute it?
- azeirah 5y agoYes, the `javascript:` prefix tells the browser to interpret the url as javascript. Try this one for example javascript:alert('hello world'); Do note that some browsers remove the `javascript:` part when you paste it into the url bar because it could easily be used maliciously so you might have to type that yourself.
- gwern 5y ago> Blocking devtools was already possible. You've patched one hole. How many more are possible? We know where this game goes...