is there any way to check which JS script added inline style to particular DOM element? I've been trying to find it manually, but I suppose there is a better way...
If you are using chrome, you can right-click the DOM element you want to watch (in the element inspector of the dev tools), and select Break On - Attributes Modifications.
That's about the closest solution I know of.
I don't think there is a "signature" for a javascript outcome on DOM so i guess you have much choice but disabling one by one your scripts.
Other choice: make a global search with parts of the style in your text editor, it must be stocked somewhere in your code.
Related
Also what is the best way to hide the elements from the DOM so that the attacker won't be able to change the css property or html attribute in order to access the element. I know we can use React or Angular to develop website and it is easier to hide or display elements. But I want to know in pure HTML & JS what is the best way?
Anyone can just use the browser console and find all elements with for example:
document.querySelectorAll('*');
It does not matter if elements are hidden with CSS.
Even if you encrypt your HTML you will have to decrypt it to show it to the browser. Then the above code still finds all the elements.
Any code you have can be deactivated by setting a breakpoint and rewriting it in-browser using the developer tools.
Even if you replace document.querySelectorAll and all like them with an empty function, developers can still just add jQuery or any DOM querying engine and find your elements that way.
Any code you can use to hide or show elements can just be executed using the browser console if someone spends the time understanding your code.
How else would you debug or test it?
Angular, Vue etc. does remove elements from the DOM but you should never expect this to be a security feature! A hacker can easily set a breakpoint anywhere in your code, inspect API results from the Network panel, go into the components' code to find out what HTML they would be rendering and much more I haven't started to mention.
To implement security you want to only have in the browser what the user needs to see.
There is no way around it.
DOM, stylings, scripts, assets, etc. can always be accessed using developer tools.
As for the question in your question title:
style attribute styles have a higher specificity than CSS from file (or style tags)
CSS from file (or style tags) with !important has higher specificity than styles from the style attribute
style attribute styles with !important have the highest specificty
So !important just overrides specificity if you want to look at it that way. Other than that you should read about CSS Specificity.
Both are same. If you store your value from html hidden or css hide. Anyone can find out them.
So if you are using html , js & css and want to pass value as hidden than disable developer tool and shortkey to open it by this way you can protect your data or else use any encryption method for that.
I'm trying to debug some styling issues on a site that has tons of .js files included. One of those scripts adds some css properties to an input element on click.
Is there an easy way to find which script and which part of it alters those css properties using Chrome Developer Tools?
Chrome Version 34.0.1847.116
In the Elements panel, right-click the element in question, and in the context menu choose Break on... > Attributes Modifications. Next time its style attribute is changed, the debugger will break on the corresponding JS line.
Use the developer tools to delete the element that changes on click. Then click the element that triggers the change. Since it can't be changed it will issue an error. The error will have a link on the right to show you exactly where it broke.
This should produce the exact file and function/script.
So say this is your element <div class="bob">Apple</div> and on click, Js adds style="color:red;" by deleting .bob you will break the script.
Note: Use developer tools to delete it. That way it doesn't permanently mess with your project.
Note2: Before deleting it, try just editing it and changing its id and/or class, like "xxbob", so it will no longer be recognized by the code.
Firebug is probably the best debugging tool that makes the life easy for developers. But one thing that I am not able to find out is how do you locate the function that changed the CSS values. In the Right Panel, when you click on any CSS rule, it will select the HTML node in the left and you get to know that these values belong to this HTML element.
Is there any way that lets you find which javascript function modified the CSS. This is shown in firebug as
element.style{
color:#898980;
top:78px;
bottom:121px;
}
I need to find which JS function changed the above values as it is not in my CSS.
The one highlighted in below Image
In the HTML panel, on the element whose style is changed : Right-click => break on attribute change.
This will break every time an attribute of this element is changed.
See also: http://www.softwareishard.com/blog/firebug/firebug-tip-break-on-html-mutation/
Florent
We have a complex RIA. A particular element has a rougue "display:none" attached to it, there is no matching CSS file when viewed in the browser inspector - so assuming a JS file somewhere is applying it dynamically. Is it possible to find out which script added it?
Thanks.
Use Firefox and Firebug.
Find the element in the Firebug DOM inspector.
Right click on it
Pick "Break on attribute change"
or
Use Chrome
Find the element in the Chrome Developer tools DOM inspector
Right click on it
Pick Break On… ➡ Attributes Modifications
That will act as if you have a break point at any point in your JS that you have code that changes the attribute. Since element.style.display = "none" gets mapped onto the style attribute, it will trigger for this.
I am using firebug to edit my magento theme. In a particular element I am getting an element.style attribute that I want to edit. Now how do I know which JS file is to be edited?
If you want to interact with elements via Javascript, you can use the console function in Firebug. Go to console, and click enable and from there you can start typing code as if it were javascript.
Example, if you wanted to check the z-index property of a specific element you could just type the javascript in the console:
document.getElementById("idOfElement").style.z-index
and when you hit enter it should tell you. You can also see errors in the javascript file if there are any.
If you are looking for the Javascript file of what is committing this change in the z-index property and you are 100% certain it is because of the Javascript, then you can use the debugger Firebug has which is also in the Scripts tab. If you're dealing with multiple javascript files, I'm not entirely sure how you can sift through which JS file is causing it, I believe you'll have to do that digging on your own. The debugger allows you step through your JS file though and see what changes are being made step-by-step.
Here is a tutorial on how to use the debugger if you're not familiar. Hope this helps.
Not sure about firebug,
But if you use linux you may try this command,
grep "element.style" -Rn .
Do you Want to change the Style or Something other.
If you want to change Style of a Particular Element, Just Follow the Steps
F12
Select Inspect Tool
Click on the Element where you want to change
In a FireBug Window look at Right and Make Sure style Tab is Selected
Just Single Click on value of a Particular Property
If you are not finding solution, Please Determine the Problem bit Clearly.