Sending console messages from the browser to the devtool process without using the renderer. |
|||||
Issue descriptionAFAIU, the current way of sending console error message from the browser is to use RenderFrameHost::AddMessageToConsole(...) The message first goes to the renderer process, then back to the browser process and finally it reaches the devtool process. It would be nice being able to avoid the round-trip in the renderer. Indeed, console error messages sometimes contain sensitive information that we would like to avoid transmitting to a possibly compromised renderer. It includes the source location of the error and the content of the message. The first time this was mentioned was in issue 718940.
,
May 11 2018
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue. Sorry for the inconvenience if the bug really should have been left as Available. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 11 2018
Making this issue to be available again. This would be a nice-to-have feature. In particular, it would allow us to display more useful console error messages when a CSP is violated. Some information in the console error message are currently removed to avoid leaking sensitive informations to a potentially compromised renderer process. See RenderFrameHostImpl::SanitizeDataForUseInCspViolation(). However I don't intend to work on it in the near future. +CC andypaicu@. FYI, because you are currently working on the 'navigate-to' CSP which also needs to sanitize the console error messages.
,
May 11 2018
,
Dec 19
,
Jan 8
This issue means that even with Site Isolation in place, we may leak cross-origin URLs (which in some cases may contain some "secrets" - see https://security.googleblog.com/2012/08/content-hosting-for-modern-web.html). Given above, should we reprioritize? |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by dgozman@chromium.org
, May 11 2017