7 ms·

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add s

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.

sosborn 4y ago
Just want to say as someone who regularly drops in code modules to insert css, you can absolutely access the block in the UI.
- pupppet 4y ago
  Yeah I thought it would be a weird oversight on MC's part to make you jump through hoops just to insert a style tag but it completely disappeared from the UI. The effect from my CSS was still there so I know it was still on the page...somewhere.
Retr0id 4y ago
Rather than it being dev tools itself, I think it's more likely that your injected <br> tags got POSTed to an API endpoint (or similar) in unescaped format, and were categorised by a WAF as attempted XSS. It's common for WAFs to block you for this kind of thing, unfortunately. Still ridiculous, but not quite the same thing as being banned for opening dev tools (of course, I am also speculating here, I guess we'd need to hear from mailchimp to be sure).
- pupppet 4y ago
  Actually just opening the dev tools triggers it. The blacklist seems to expire on its own so I went ahead and opened the dev tools and did nothing more, reloaded, blocked.
  - justinclift 4y ago
    Hopefully it doesn't have a "lets permanently ban this repeat offender" thing. (!)
  - dylan604 4y ago
    This is interesting as something I've never thought about. What signaling to the server does the browser do when devtools are opened, and I guess I have to ask why is it signaling to the server anything at all if it is? Edit: i see that people have replied with answers to this further down the page
    - deleted 4y ago
      [deleted]
temp12192021 4y ago
https://sindresorhus.com/devtools-detect/ https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window
- lewisl9029 4y ago
  Vertical tabs in Edge seems to trigger false positives on this. Really hope that's not the only heuristic they're using.
  - ajot 4y ago
    Same goes for Sidebery in Firefox, but then it changes to "no" if I do open the Dev Tools. As a non web-dev, this behaviour is truly weird.
    - sli 4y ago
      Looking at the code[0], it just defines an aspect ratio threshold (170px in either direction, on line 13) for your browser's viewport and triggers if it's outside of that on width or height. So when you open a second panel, your viewport goes back to being closer to 16:9/16:10 and the tool considers that within both thresholds. The detection is hilariously primitive, entirely unreliable, and only knows about your devtools directly if you're using Firebug. [0]: https://github.com/sindresorhus/devtools-detect/blob/main/index.js#L25 https://github.com/sindresorhus/devtools-detect/blob/main/in...
- Nullabillity 4y ago
  Tree Style Tab is apparently detected as vertical dev tools, and opening the horizontal dev tools changes it to no. This is kind of hilarious.
- deathanatos 4y ago
  … that incorrectly detects devtools as open, when it isn't (false positive), and fails to detect devtools when it is open in a separate window (false negative)… Yeah, as other posters hint at, vertical tabs. But it isn't just vertical tabs that'll trigger it, any sidebar will, including native/vanilla ones; AFAICT it's just looking at the client area being less than the window by some threshold.

sosborn 4y ago

Just want to say as someone who regularly drops in code modules to insert css, you can absolutely access the block in the UI.

pupppet 4y ago
Yeah I thought it would be a weird oversight on MC's part to make you jump through hoops just to insert a style tag but it completely disappeared from the UI. The effect from my CSS was still there so I know it was still on the page...somewhere.

Retr0id 4y ago

Rather than it being dev tools itself, I think it's more likely that your injected <br> tags got POSTed to an API endpoint (or similar) in unescaped format, and were categorised by a WAF as attempted XSS. It's common for WAFs to block you for this kind of thing, unfortunately. Still ridiculous, but not quite the same thing as being banned for opening dev tools (of course, I am also speculating here, I guess we'd need to hear from mailchimp to be sure).

pupppet 4y ago
Actually just opening the dev tools triggers it. The blacklist seems to expire on its own so I went ahead and opened the dev tools and did nothing more, reloaded, blocked.
- justinclift 4y ago
  Hopefully it doesn't have a "lets permanently ban this repeat offender" thing. (!)
- dylan604 4y ago
  This is interesting as something I've never thought about. What signaling to the server does the browser do when devtools are opened, and I guess I have to ask why is it signaling to the server anything at all if it is? Edit: i see that people have replied with answers to this further down the page
  - deleted 4y ago
    [deleted]

temp12192021 4y ago

https://sindresorhus.com/devtools-detect/ https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

lewisl9029 4y ago
Vertical tabs in Edge seems to trigger false positives on this. Really hope that's not the only heuristic they're using.
- ajot 4y ago
  Same goes for Sidebery in Firefox, but then it changes to "no" if I do open the Dev Tools. As a non web-dev, this behaviour is truly weird.
  - sli 4y ago
    Looking at the code[0], it just defines an aspect ratio threshold (170px in either direction, on line 13) for your browser's viewport and triggers if it's outside of that on width or height. So when you open a second panel, your viewport goes back to being closer to 16:9/16:10 and the tool considers that within both thresholds. The detection is hilariously primitive, entirely unreliable, and only knows about your devtools directly if you're using Firebug. [0]: https://github.com/sindresorhus/devtools-detect/blob/main/index.js#L25 https://github.com/sindresorhus/devtools-detect/blob/main/in...
Nullabillity 4y ago
Tree Style Tab is apparently detected as vertical dev tools, and opening the horizontal dev tools changes it to no. This is kind of hilarious.
deathanatos 4y ago
… that incorrectly detects devtools as open, when it isn't (false positive), and fails to detect devtools when it is open in a separate window (false negative)… Yeah, as other posters hint at, vertical tabs. But it isn't just vertical tabs that'll trigger it, any sidebar will, including native/vanilla ones; AFAICT it's just looking at the client area being less than the window by some threshold.