Calling console.clear() from iFrame also removes messages from parent document
Reported by
nikhil...@gmail.com,
Jan 20 2017
|
|||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36 Steps to reproduce the problem: 1. Unzip the file attached. 2. Open index.html 3. View source for both HTML files 4. Check the console in dev tools. The iFrame clears messages of parent frame from the console. What is the expected behavior? When an iFrame calls console.clear() only those messages should get cleared from the console that were logged by that particular iFrame. An iFrame should not have permissions to clear console messages of parent document. What went wrong? Calling console.clear() on an iFramed document cleared the console completely, including for parent. Did this work before? N/A Does this work in other browsers? No Firefox also behaves in this way i.e., calling console.clear() from an iFrame clears the entire console, including messages from parent document. Chrome version: 55.0.2883.95 Channel: stable OS Version: OS X 10.12.2 Flash Version: Shockwave Flash 24.0 r0
,
Jan 20 2017
Tested the issue on chrome Stable #55.0.2883.95, Canary 57.0.2976.0 in Mac 10.12.2 and was able to reproduce the issue. This is a Non-Regression issue since seeing this from M30 #30.0.1549.0, Making the status to Untriaged so that the issue would get addressed. Note : Unable to test in Ubuntu 14.04 & win 10.0 with provided files. Thank you!
,
Jan 24 2017
Not sure exactly how console is wired up, but IIRC it's via V8 and there you're not dealing with iframes so much as contexts? Hopefully one of these labels gets the right engineer.
,
Jan 30 2017
,
Jan 31 2017
I think this is purely DevTools.
,
Apr 26 2017
I just ran into an ad using this to cover up their code errors (and wiping out devtools coverage of the rest of the website).
,
Apr 26 2017
,
Apr 26 2017
Yes, it's part of current inspector behavior. We can improve it and then console.clear will cleanup only message from current context, it sounds reasonable to me. Dmitry, WDYT?
,
Apr 26 2017
It worked like this for a long time. We should study how people use it before deciding.
,
Apr 26 2017
3rd party content (usually ads) are the biggest problem as @orangewi... discovered. That is what originally led me to discover and report this bug. But @dgozman's concern is also valid so I propose this: If the user opens devtools and types in console.clear() in any context, it clears the entire console for all contexts. But if a 3rd party script within an iFrame invokes console.clear() then it should only be allowed access to its own context.
,
Oct 16 2017
,
Feb 1 2018
,
May 29 2018
|
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by karandeepb@chromium.org
, Jan 20 2017