6 ms·

To see the actual source in Firefox 6, I just viewed the source without dismissing the alert, there was no need to disable anything. The only thing is that with

To see the actual source in Firefox 6, I just viewed the source without dismissing the alert, there was no need to disable anything. The only thing is that with the alert, I couldn't right click on the page and click on "View Page Source", I had to use the menu item Tools: Web Developer: Page Source (or its keyboard shortcut).

dave1010uk 15y ago
I used an alert as a quick example. You could put any HTML or JS on the page (e.g. links for SEO value, iframes with PDF exploits, a bitcoin miner or a video of Rick Astley) and when someone views the source it looks like there's nothing malicious. Ctrl/Cmd-u can also be used to view source in Firefox.
- fgaaghf 15y ago
  If you want to view the current HTML source in Firefox you can use Ctrl+A and then right-click > "View Selection Source". I think it's more a question of what do you expect to see when you "View Source". For example, I have messed around with document.write a lot and it's pretty obvious to me that, if I use view source then it's going to give me the source and any changes done to it my document.write/open/close. In this case since document.write is used after HTML parsing has been completed it replaces the whole page and thus makes view source rather pointless.
  - dave1010uk 15y ago
    This bug isn't showing the usual generated source but some kind of hybrid between original source and generated source. - To see the original source, hit ctrl-u before dismissing the alert. - To see the "hybrid" source, hit ctrl-u after dismissing the alert. I always expected this to be idential to what the webserver sent, just syntax highlighted. (Though I haven't messed around with document.close before.) - To see the generated source, hit ctrl-a, right click & "View Selection Source". This is different to the original/hybrid source as Firefox inserts html tags to make the page valid. My example had no html, head, title or body tags. This should reflect the current page DOM, as affected by any JavaScript.
- tspiteri 15y ago
  My intention was to suggest an easy way to view the actual source. I think your example is actually better as an example as it is easy to see the source both before and after the function is called.

dave1010uk 15y ago

I used an alert as a quick example. You could put any HTML or JS on the page (e.g. links for SEO value, iframes with PDF exploits, a bitcoin miner or a video of Rick Astley) and when someone views the source it looks like there's nothing malicious. Ctrl/Cmd-u can also be used to view source in Firefox.

fgaaghf 15y ago
If you want to view the current HTML source in Firefox you can use Ctrl+A and then right-click > "View Selection Source". I think it's more a question of what do you expect to see when you "View Source". For example, I have messed around with document.write a lot and it's pretty obvious to me that, if I use view source then it's going to give me the source and any changes done to it my document.write/open/close. In this case since document.write is used after HTML parsing has been completed it replaces the whole page and thus makes view source rather pointless.
- dave1010uk 15y ago
  This bug isn't showing the usual generated source but some kind of hybrid between original source and generated source. - To see the original source, hit ctrl-u before dismissing the alert. - To see the "hybrid" source, hit ctrl-u after dismissing the alert. I always expected this to be idential to what the webserver sent, just syntax highlighted. (Though I haven't messed around with document.close before.) - To see the generated source, hit ctrl-a, right click & "View Selection Source". This is different to the original/hybrid source as Firefox inserts html tags to make the page valid. My example had no html, head, title or body tags. This should reflect the current page DOM, as affected by any JavaScript.
tspiteri 15y ago
My intention was to suggest an easy way to view the actual source. I think your example is actually better as an example as it is easy to see the source both before and after the function is called.