I'm new to javascript and I want to ask if there is any way to modify javascript code that was loaded from the server side? There is an external script <script src="myscripts.js"></script>
Can I modify this, let's say with Google Chrome inspector. I want to alter for example, one of the script's functions. Can I do it?
Yes, you can.
However, if you refresh (or the script is requested again) you'll get the original script from the server.
JavaScript cannot be modified on the client. Think of the havoc this would cause if you could.
Related
I want to develop an extension which works on scripts coming from HTTP response. I know that whole HTML code first goes to rendering engine inside browser where it is parsed to create a DOM tree. Any script embedded inside is passed to the JavaScript Engine.(Correct me if I am wrong. :) )
So I wanted to intercept the JavaScript code before it is sent to the JavaScript Engine in order to modify them accordingly.
Are there any APIs for Mozilla Firefox which would allow me to do this? How can I do it?
while doing some stuff i stumbled across this:
https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/NsITraceableChannel?redirectlocale=en-US&redirectslug=NsITraceableChannel
this allows you to modify stuff before it is parsed. see this topic here:
http://forums.mozillazine.org/viewtopic.php?f=19&t=2800541
here is a working example of getting the content before it is shown to user. it doesnt change it though, thats what im asking in the mozillazine topic. the writeBytes should modify it, once you figure it out please share as im interested as well
https://github.com/Noitidart/demo-nsITraceableChannel
You can follow this answer on how to intercept each request and modify before sending it to the page itself. You can do transpilation or whatever you'd like there.
take a look at this guys addons code. he does exactly what you are looking for:
https://addons.mozilla.org/en-US/firefox/addon/javascript-deminifier/
You can try invade before HTML'll be parsed and take all tags, work with them and put it back.
...I wanted to intercept these javascript code before Javascript Engine and modify them accordingly. Is there any APIs for mozilla firefox? How can I do it?
You can use page-mod of the Addon-SDK by setting contentScriptWhen: "start"
Then after completely preventing the document from getting parsed you can fetch the same document on the side, do any modifications and inject the resulting document in the page. Here is an answer which does just that https://stackoverflow.com/a/36097573/6085033
I am developing an application and have some important information inside the code like IPs and stuff which has to be private. I use apache web server as a server and wanna know if there is any way hide a javascript code or moving it outside root folder ?
No, by definition. Javascript code is run on the client's computer. That means that the client must have access to the Javascript source for it to work. You could use AJAX to hide certain data until it is needed, but even then the client (and any user with Firebug) would be able to view it.
The only way to "hide" it would be through some sort of obfuscation utility or to minify the javascript. But, unfortunately, once the javascript code makes it to the browser. There is not much you can do about it.
I was just wondering what the simplest javascript function would be to request a server side .js file. Currently I have a jquery-1.4.2.min file that weighs in at 70kb, and I figured that there has to be a way, using javascript, to request this file. That way, if the user doesn't have javascript enabled the function would be ignored and the jquery file wouldn't have to be downloaded, thus speeding up the download of the page and decreasing the bandwidth used by the server.
Also if this works, would the file just be downloaded, or would the page begin to use it? Thanks in advance!
Most browsers already don't download JavaScript when it's disabled, so this is an over-optimization for most browser users. If I can find the question on it I'll update this...but it's something you don't need to handle :)
Edit: Here's that question, though I think there's another similar one as well.
Something else to keep in mind is that the user will only download it once if your cache headers are set correctly. Also take a look at using a CDN for your jQuery include.
If the user doesn't have javascript enabled, <script> elements with src attributes will be ignored.
If you really want to, you can document.write() the script tag or create a script element and append it. If js is disabled it will never happen. But others have mentioned already, for most modern browsers, the script tag will simply be ignored if js is disabled, so it's overkill.
I've been building a site. At some stage I noticed that IE display was a little broken and Chrome had all but rendered nothing but the body tag (empty), and FF all looked good.
After throwing my keyboard around the room and bashing my head against my mouse, I discovered the problem. I had left (don't ask how or why, must have been some lightning speed cut and paste error) an HTML comment unclosed in an inline script block.
<script type="text/javascript">
<!--
...
</script>
I'm guessing (not tested) the problem would have either not come up, or manifested itself in a far more noticeable way if the script was external. So anyways, I got to thinking, is there ever a time when you have a really good reason to write inline script??
No. Write Unobtrusive Javascript.
If you want your Javascript to run as early as possible, it might make sense to include inline Javascript, since it will run before any other HTTP requests have necessarily completed.
And in some cases, you're including Javascript from a 3rd party provider and you don't really have a choice. Certain ad systems, as well as Google Analytics, spring to mind.
If the script must be dynamically generated (say by a PHP or ASP.NET MVC page) would be one reason to have it inline :-)
Depends on how much JS do you plan to write. If you're writing many support routines (lots of validation checks, text processing, animation and effects) then it makes sense to have the code in a separate file. This allows code reuse and removes a lot of junk from your HTML page.
On the other hand, there is no need to put 10 lines of code, or a single function (a refresh JS comes to mind) in a separate file. It will also load slightly faster, since the browser does not need to make an additional HTTP request to download the separate JS file.
Most XSS vulnerabilities can only be exploited using inline javascript.
It's not necessarily enough of a reason, but the pages will load faster. To this end, sometimes, even when you write the script in another file, you want it to show up as inline on the client side.
I sometimes place javascript inline in pages that get partially reloaded (to bind some events to newly added form-fields for example) and / or pages that use some unique javascript that I will not use on any other page.
Having many external scripts can ultimately slow down the page as the browser must call each file separately. Combining the JavaScript into one file or into the page itself can sometimes alleviate this problem.
On the other hand, I believe the browser may cache a script file once it's been called for the first time so if you have a lot of the same code across your site, external is the way to go.
I work a good deal in something called Flex, which combines XML and ActionScript to create the final bytecode. It is ALWAYS best practice to separate the two as much as possible. That way, you can very clearly and easily separate the View (the HTML or MXML in my case) from the Controller (the script)
It also means that you do not have to worry about looking through five files for one line of code -- all of your code is in one place.
File caching is the reason to have external js and css files. Even if you only have one HTML page, this page is likely to be updated often and so will be downloaded by the browser as often. If the js (and css) are in the HTML page, that too will be downloaded often. Keeping them separate will keep the HTML file smaller and will download faster. The js and css files will have been cached so will not be continually downloaded. That is assuming these files are not updated very often.
This question already has answers here:
How do I hide javascript code in a webpage?
(12 answers)
Closed 8 years ago.
How do I hide my javascript/jquery scripts from html page (from view source on right click)? please give suggestion to achive this .
Thanks.
You can't hide the code, JavaScript is interpreted on the browser. The browser must parse and execute the code.
You may want to obfuscate/minify your code.
Recommended resources:
CompressorRater
YUI Compressor
JSMin
Keep in mind, the goal of JavaScript minification reduce the code download size by removing comments and unnecessary whitespaces from your code, obfuscation also makes minification, but identifier names are changed, making your code much more harder to understand, but at the end obfuscation gives you only a false illusion of privacy.
Your best bet is to either immediately delete the script tags after the dom tree is loaded, or dynamically create the script tag in your javascript.
Either way, if someone wants to use the Web developer tool or Firebug they will still see the javascript. If it is in the browser it will be seen.
One advantage of dynamically creating the script tag you will not load the javascript if javascript is turned off.
If I turned off the javascript I could still see all in the html, as you won't have been able to delete the script tags.
Update: If you put in <script src='...' /> then you won't see the javascript but you do see the javascript file url, so it is just a matter of pasting that into the address bar and you d/l the javascript. If you dynamically delete the script tags it will still be in the View Source source, but not in firebug's html source, and if you dynamically create the tag then firebug can see it but not in View Source.
Unfortunately, as I mentioned Firebug can always see the javascript, so it isn't hidden from there.
The only one I haven't tried, so I don't know what would happen is if you d/l the javascript as an ajax call and then 'exec' is used on that, to run it. I don't know if that would show up anywhere.
It's virtually impossible. If someone want's your source, and you include it in a page, they will get it.
You can try trapping right click and all sorts of other hokey ways, but in the end if you are running it, anyone with Firefox and a 100k download (firebug) can look at it.
You can't, sorry. No matter what you do, even if you could keep people from being able to view source, users can alway use curl or any similar tool to access the JavaScript manually.
Try a JavaScript minifier or obfuscator if you want to make it harder for people to read your code. A minifier is a good idea anyhow, since it will make your download smaller and your page load faster. An obfuscator might provide a little bit more obfuscation, but probably isn't worth it in the end.
Firebug can show obfuscation, and curl can get removed dom elements, while checking referrers can be faked.
The morale? Why try to even hide javascript? Include a short copyright notice and author information. If you want to hide it so an, say, authentication system cannot be hacked, consider strengthening the server-side so there are no open holes in server that are closed merely though javascript. Headers, and requests can easily be faked through curl or other tools.
If you really want to hide the javascript... don't use javascript. Use a complied langage of sorts (java applets, flash, activex) etc. (I wouldn't do this though, because it is not a very good option compared to native javascript).
Not possible.
If you just want to hide you business logic from user and not the manipulation of html controls of client side than you can use server side programming with ajax.