Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts.

Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at least allow me to inspect the source safely.

But intuition is a terrible way to draw conclusions on security issues, so my question is:

Is view-source a safe way to look at a website from a js script injection perspective?

  • 3
    Just as bugs in the JS implementation might be vulnerable to attacks, so too might the source renderer, syntax highlighter, etc. Of course, the attack surface is smaller, but it's still larger than wget or curl, and even those might have vulnerabilities.
    – Max
    Commented Mar 30, 2015 at 13:58
  • 1
    alternatively, you can do curl http://url.ext from the terminal, but some websites might not serve proper markup to non-browser user-agents, so you will have to spoof your UA with curl -A "user-agent-here" http://url. Commented Mar 30, 2015 at 18:42

3 Answers 3


Yes, it is absolutely safe (in Google Chrome) to open an untrusted website in view-source mode. The key point to note here is that you should "open" the page in view-source mode, meaning you should not allow any rendering to happen by normally loading the webpage first and then viewing the source.

An example in Google Chrome would be view-source:http://www.badjs.com/

By design, Google Chrome will initiate a new GET request to the server and provide the client browser with the unrendered version of the webpage when in view-source mode.

You could also use a No-Script extension or add-on for your specific browser to prevent any scripting attacks.

  • 2
    Thanks. Yes that was exactly what I meant: navigate directly to the view-source prefixed URL.
    – tohster
    Commented Mar 29, 2015 at 16:57
  • 2
    view-source works for me in Firefox 36, too. Commented Mar 29, 2015 at 19:34
  • 2
    Yes its working in Firefox 36, but not in IE 11. Firefox does not seem to initiate a new GET request when viewing source after it has rendered the webpage. Could someone who knows the internal workings of Firefox please corroborate that it is infact safe to directly use view-source in Firefox 36? Commented Mar 29, 2015 at 20:15
  • 4
    Since you cannot speak for other browsers, I would not say "it is absolutely safe". And, IIRC, long ago I saw some browsers show HTML source of the page after JavaScript modified it.
    – jamesdlin
    Commented Mar 29, 2015 at 20:27
  • 2
    @Joseph: Can confirm: i.sstatic.net/ygExH.png
    – bwDraco
    Commented Mar 30, 2015 at 5:19

While it is currently safe on Chrome you should not base your future checks on that. Things may change anytime and I have not seen the lack of rendering as being a specifically documented feature.

If you want to look at the code, it is much better to download the page via a command-line tool (curl for instance) and analyze what was loaded and saved in a file. This also has the added value of easily testing various pages which may be possibly served in response to different User-Agents.

  • 2
    Of course, there is no guarantee of absense of bugs, so even curl might be unsafe for non-js reasons. Commented Mar 30, 2015 at 15:13
  • 4
    @FilipHaglund: this is not a matter of bugs: one day Google may decide that it will render the source in the view-source page (to make it dynamic, nicer, whatever). By downloading the page with a command-line downloader like curl you just issue a GET and save what is returned by the server in a file. There is no processing done because the job of curl is not to process anything (it is designed for that). You may have bugs in the implementation and have problems with some pages, but not security ones (as the attacks happen in whatever renders the page).
    – WoJ
    Commented Mar 30, 2015 at 17:33

While there is nothing wrong with the other answers saying it is currently safe, there is a potential misunderstanding going on. You said you wanted to use it to check if a site is safe, so presumably you will load a page normally after you have found no malicious content when viewing the source. If this is true, then you must be aware that websites are able to detect (or at least infer) that you are using view-source:. Not only does it, on Firefox at least, not use the cache, resulting in it loading the page a second time, but it does not load other resources. If a site sees someone with a regular browser user agent connect but load no other resources, they can infer that the user is checking the source. It is simple to automate this detection and only serve malicious JavaScript from a resource in the case that it is loaded along with all the rest of the page. This would hide its presence from your inspection of the source, despite the website still serving malicious JavaScript to you.

A potential solution would be to use Inspect Element, which looks at the currently open page and allows for reading the source. This is much harder to detect (though not impossible, since CSS can determine the size of the browser window, which shrinks by a specific amount when inspect element is open). Inspect Element is more complex, and may be more exploitable than view-source:, so you must apply threat modeling in this situation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .