← blog

Bypassing Client-Side Validation & Disabled Inputs

I find it absolutely fascinating whenever I encounter a disabled option or button on a website. It's like stumbling upon a secret door that the admin has intentionally locked. I mean, who knows what wonders lie behind that forbidden entrance? Of course, we can't actually see what's behind it because, well, it's disabled. But hey, sometimes the logic behind disabling it is right there in front of us, cleverly hidden within the source code.

Just recently, I had the pleasure of submitting a form with multiple steps. During my journey through this labyrinth of fields, I happened to make a mistake on the second step. Lo and behold, on the final step, the form decided to display all the inputs at once, including the one where I goofed up. How delightful!

In a moment of genius, I opened the NETWORK tab in the developer console and discovered that the API method was a magnificent PUT. Ah, the satisfaction of knowing that each step was dutifully mutating the original record, ready to mutate it once again on the third step. Such elegance!

Without skipping a beat, I ventured into the INSPECT tab like a brave explorer. Navigating to the disabled input, I fearlessly removed the treacherous property known as disabled="true". And then, with a stroke of genius, I typed in the correct value. You see, I knew that the function responsible for the onChange event would surely update the new value in the form's state, ready to be processed on the elusive third step.

With great anticipation, I struck the final submit button, and voila! The form submitted without a single hiccup. Ah, the thrill of bending the rules! This little trick tends to work like a charm because, you know, sometimes the logic to disable things is only implemented on the client side. Who cares about enforcing it on the backend to validate incoming requests? Not us rebels, that's for sure!

A Similar GCP Adventure

But wait, there's more! I also encountered a similar escapade within the depths of the Google Cloud Platform. You see, my generous company granted me the absolute minimum access to merely gaze upon the sacred logs in production. And wouldn't you know it, an issue arose that dared to throw an error in my face. Naturally, I needed to investigate if the correct environment variables were playing their part in this grand production play.

To my dismay, the option to view those sacred variables was disabled. Oh, the audacity! But fear not, for I applied the same mystical trick once again, and lo and behold, it worked like a charm! The forbidden screen that was never meant to be accessible to someone of my humble role was laid bare before my eyes and then I cross-checked the environment variables and they were correct.

Alas, my joy was short-lived as my attempts to modify those variables triggered a feeble request, only to be swiftly denied by the mighty permission gods.