View Rendered Source
ID: ejgngohbdedoabanmclafpkoogegdpob
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Peg Leg LtdView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Email Change History
View source is dead. See how the browser renders a page, not just what the server sends.
A lightweight Chrome Extension that shows you how the browser has constructed (rendered) a page's original HTML into a functioning DOM, including modifications made by JavaScript. An essential tool for web developers using JavaScript frameworks like Angular, ReactJS and Vue.js, and for SEOs to understand how search engines see your pages, especially considering Google's dynamic serving workaround. Differences between raw and rendered versions are highlighted line-by-line showing how JavaScript has modified a page at render time. ---------------------------------------------------- There are 3 sections: * Raw: The source code sent from the server to the browser before the DOM is rendered. The same as you'll see with traditional 'View Source' in the browser (after minor formatting tweaks) * Rendered: The rendered page after the source has been interpreted into a DOM, including any modifications made by Javascript * Difference: The difference between the rendered source and the raw source. Differences occur when JavaScript has modified the DOM. ---------------------------------------------------- Adaptive website? If you serve different source code to mobile devices, emulate this easily with a mobile user-agent checkbox. Dynamic serving for Google? (More info: https://developers.google.com/search/docs/guides/dynamic-rendering) Using Google's dynamic rendering workaround designed for Javascript-heavy sites? Just request the raw source as Googlebot and ensure perfect technical SEO. Works with GatsbyJS and Prerender. ---------------------------------------------------- Problems? Questions? Suggestions? DM the developer: https://twitter.com/ItsHogg ----------------------------------------------------
The extension's UI page loads `beam.min.js` with a `data-token` attribute (UUID `ebb8553f-6884-435c-bb2e-cfa7d45e098c`), which is the loader signature of Beam Analytics — a third-party usage/telemetry tracking service. This sends extension-usage analytics (URLs the user views rendered source for, timing, environment) to a third-party endpoint without disclosed consent. Note: the referenced `beam.min.js` file is not present in the bundle, so the script tag may currently fail to load, but the tracking-instrumentation intent is clearly embedded.
<head> <meta charset="utf-8"> <title>View Rendered Source</title> <link rel="stylesheet" href="style.css" /> <!-- <link id="highlight-style" rel="stylesheet" href="light.css"> --> <script src="beam.min.js" data-token="ebb8553f-6884-435c-bb2e-cfa7d45e098c" async></script></head>The content script (injected at `document_start` on `<all_urls>`) captures the entire rendered DOM (`document.documentElement.outerHTML`) of any page the user is on whenever the background page requests it. While this is consistent with the extension's stated purpose, the captured DOM may include sensitive content (logged-in dashboards, banking pages, internal apps) and is converted into a blob URL accessible to the extension page; only the user-initiated action triggers the request, but no domain restriction or consent prompt is applied.
chrome.runtime.onMessage.addListener(function(request, sender, sendResponse) { if (DOMLoaded) { //Get rendered DOM as string, turn it into an array, then a blob, then create an object URL of the blob which can be passed to background.js. Crikey. var outerHTML = document.documentElement.outerHTML; var doctypeNode = document.doctype; ... var renderedDOMString = outerHTML; var renderedDomArray = [renderedDOMString]; var renderedBlob = new Blob(renderedDomArray, { type: 'text/plain' }); var renderedObjURL = URL.createObjectURL(renderedBlob); var userAgent = navigator.userAgent; sendResponse({ "payload": renderedObjURL, "doctype": doctype, "userAgent": userAgent }); }});The extension page re-fetches the active tab's URL via XHR using the host permissions `http://*/*` and `https://*/*`. Because the request is made from the extension origin (not the user's authenticated session for that site), this is by design, but the broad host permissions plus arbitrary-URL XHR (`xhr.open('GET', url, true)` where `url` comes from the tab) means a malicious page could potentially be re-fetched with extension privileges. Risk is mitigated by user-initiated invocation, but worth noting given the broad host scope.
chrome.tabs.get(parseInt(tabID), function(tab) { ... rawURL = tab.url; ... chrome.storage.local.get(renderedDOMKey, function(result) { var renderedBlobURL = result[renderedDOMKey]; fetchSource(renderedBlobURL, 'rendered'); fetchSource(rawURL, 'raw'); });});...function fetchSource(url, type) { ... var xhr = new XMLHttpRequest(); xhr.open('GET', url, true); xhr.timeout = 10000; xhr.responseType = 'text'; ... xhr.send();}By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 4.0 | 3 |
Files with findings
3 distinct paths — top paths by unique finding count:
- content.js1
- viewrenderedsource.html1
- viewrenderedsource.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.