Console block - solution
Reported by
renatobu...@gmail.com,
Sep 19 2017
|
|||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.91 Safari/537.36 Steps to reproduce the problem: Not found. What is the expected behavior? It would be nice if in the browser manifest could by an immutable script about the URL that when someone wobble in the console to mofificar codes to add rows in the DOM an emit for this script be advising and it to have options to stop the application preventing the user badly intentioned to move the code What went wrong? It would be nice if in the browser manifest could by an immutable script about the URL that when someone wobble in the console to mofificar codes to add rows in the DOM an emit for this script be advising and it to have options to stop the application preventing the user badly intentioned to move the code Did this work before? No Chrome version: 61.0.3163.91 Channel: stable OS Version: 10.0 Flash Version: It would be nice if in the browser manifest could by an immutable script about the URL that when someone wobble in the console to mofificar codes to add rows in the DOM an emit for this script be advising and it to have options to stop the application preventing the user badly intentioned to move the code
,
Oct 2 2017
Thank you for the report. Unfortunately, I do not completely understand what you mean. Could you please try rephrasing your request, or maybe provide a picture or screenshot of what you are describing? We should be able to provide more help with more info. When you said 'block' or 'stop the application', are you referring to pausing the DevTools debugger? Perhaps your request might already be addressed by adding a DOM Breakpoint on the document body to break on "Subtree modifications": https://developers.google.com/web/tools/chrome-devtools/javascript/breakpoints#dom
,
Oct 2 2017
I mean when some malicious user open the console log typing something or edit the html, having a configuration does not manifest something of the type that is sent a callback to the script to know what is happening
example:
conf.js ---------------------------------------------------------------
console.addeventListen("write,edit,remove",function(e){
if(e.console.readLine() == "teste"){
alert("On the console only test can be typed");
}else{
alert("You can not move the code.");
}
});
Resume:
inhibit malicious user action
,
Oct 2 2017
Ah, I think I understand better. It sounds like you want to prevent users from entering certain commands in the DevTools console.
For this use case, there is no way for a web page to listen for events in the DevTools console prompt (no such "write,edit,remove" events), no way to read the text contents of the prompt ("e.console.readLine()"), and no way to cancel or prevent users from evaluating commands in the console.
This is part of the open model to allow users to view the source and debug any website they visit using DevTools. Exposing DevTool's console to the inspected web page would break our model. However, there might still be some options that interest you:
- MutationObservers can be created from the website's script, allowing you to run a function whenever the DOM changes. However, this function is run after the DOM has already changed, so you could alert() but there is no way to prevent the cancel or prevent the change.
https://developer.mozilla.org/en-US/docs/Web/API/MutationObserver
- If you are concerned about protecting good users who visit a website by preventing them from pasting malicious code in the console, you could consider logging a large message to warn users from your page's script. For example:
https://stackoverflow.com/questions/27415145/how-does-facebook-log-to-console-like-this
- If you are concerned about securing your application, then perhaps you are interested in server-side validation.
Marking this ticket as 'WontFix' because it works as intended, as we actively try to make sure that DevTools is not exposed to the inspected web page. If you still have questions, or if I have missed something, please add your comment and I will take a look.
|
|||
►
Sign in to add a comment |
|||
Comment 1 by ligim...@chromium.org
, Sep 19 2017Status: Untriaged (was: Unconfirmed)