New issue
Advanced search Search tips

Issue 766670 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Closed: Oct 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Feature



Sign in to add a comment

Console block - solution

Reported by renatobu...@gmail.com, Sep 19 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.91 Safari/537.36

Steps to reproduce the problem:
Not found.

What is the expected behavior?
It would be nice if in the browser manifest could by an immutable script about the URL that when someone wobble in the console to mofificar codes to add rows in the DOM an emit for this script be advising and it to have options to stop the application preventing the user badly intentioned to move the code

What went wrong?
It would be nice if in the browser manifest could by an immutable script about the URL that when someone wobble in the console to mofificar codes to add rows in the DOM an emit for this script be advising and it to have options to stop the application preventing the user badly intentioned to move the code

Did this work before? No 

Chrome version: 61.0.3163.91  Channel: stable
OS Version: 10.0
Flash Version: 

It would be nice if in the browser manifest could by an immutable script about the URL that when someone wobble in the console to mofificar codes to add rows in the DOM an emit for this script be advising and it to have options to stop the application preventing the user badly intentioned to move the code
 
Components: Platform>DevTools
Status: Untriaged (was: Unconfirmed)

Comment 2 by l...@chromium.org, Oct 2 2017

Cc: l...@chromium.org
Labels: Needs-Feedback
Thank you for the report.  Unfortunately, I do not completely understand what you mean.  Could you please try rephrasing your request, or maybe provide a picture or screenshot of what you are describing?  We should be able to provide more help with more info.

When you said 'block' or 'stop the application', are you referring to pausing the DevTools debugger?  Perhaps your request might already be addressed by adding a DOM Breakpoint on the document body to break on "Subtree modifications":
https://developers.google.com/web/tools/chrome-devtools/javascript/breakpoints#dom
I mean when some malicious user open the console log typing something or edit the html, having a configuration does not manifest something of the type that is sent a callback to the script to know what is happening


example:

conf.js --------------------------------------------------------------- 

 console.addeventListen("write,edit,remove",function(e){
   
   if(e.console.readLine() == "teste"){

       alert("On the console only test can be typed");

    }else{ 

       alert("You can not move the code.");


   }

 });

Resume: 

inhibit malicious user action




Comment 4 by l...@chromium.org, Oct 2 2017

Cc: -l...@chromium.org
Labels: -Needs-Feedback
Owner: l...@chromium.org
Status: WontFix (was: Untriaged)
Ah, I think I understand better.  It sounds like you want to prevent users from entering certain commands in the DevTools console.

For this use case, there is no way for a web page to listen for events in the DevTools console prompt (no such "write,edit,remove" events), no way to read the text contents of the prompt ("e.console.readLine()"), and no way to cancel or prevent users from evaluating commands in the console.

This is part of the open model to allow users to view the source and debug any website they visit using DevTools.  Exposing DevTool's console to the inspected web page would break our model.  However, there might still be some options that interest you:

- MutationObservers can be created from the website's script, allowing you to run a function whenever the DOM changes.  However, this function is run after the DOM has already changed, so you could alert() but there is no way to prevent the cancel or prevent the change.
https://developer.mozilla.org/en-US/docs/Web/API/MutationObserver

- If you are concerned about protecting good users who visit a website by preventing them from pasting malicious code in the console, you could consider logging a large message to warn users from your page's script.  For example:
https://stackoverflow.com/questions/27415145/how-does-facebook-log-to-console-like-this

- If you are concerned about securing your application, then perhaps you are interested in server-side validation.


Marking this ticket as 'WontFix' because it works as intended, as we actively try to make sure that DevTools is not exposed to the inspected web page.  If you still have questions, or if I have missed something, please add your comment and I will take a look.

Sign in to add a comment