|September 2004 Update: Support for the view-source protocol was removed in service pack 2 for Windows XP and therefore notepad popups no longer work on computers running service pack 2.|
A Notepad popup is a text window which is displayed by a HTML email message or Web page using the Windows Notepad utility. Click here for a sample popup. (If you are using Internet Explorer for your browser, the demo should have already popped up.)
A Notepad popup Window is displayed in Internet Explorer using the "view-source:" protocol. This protocol takes a complete URL as an argument and displays the HTML source code of the URL in the Notepad utility. For example, this view-source URL shows the HTML source code of the Google home page:
view-source:http://www.google.comThe view-source protocol also works with plain text files as well as files on the local hard drive. For example, this view-source URL will display the win.ini file from the c:\windows directory:
http://www.websitemedics.com/frames/index.htmlIn Internet Explorer, the view-source URL can be used in pretty much in any HTML tag that works URLs. For example, this <IMG> will automatically pop up a Notepad window in an HTML email message or Web page when a page is loaded:
<img src=view-source:http://www.computerbytesman.com/security/npexample.txt>Here are some unfortunate side effects of view-source URLs being allowed in all HTML tags:
In addition, a Web page or HTML email message should not be able to access files residing on the hard disk via a view-source URL.