Obsolete
Status Update
No update yet.
Comments
va...@chromium.org
This is unlikely a security issue (Cr-Security to confirm).
Inputting stuff in Devtools is also not the usual way the browser is used. It is meant for developers who know what they do.
Inputting stuff in Devtools is also not the usual way the browser is used. It is meant for developers who know what they do.
sl...@fastmail.com
Nothing is inputed by the user, the console.log() is in the HTML code of the page
va...@chromium.org
Thanks for the clarification!
But still this only affects users who open the DevTools, and the loss of privacy through disclosing that they opened DevTools looks negligible.
But still this only affects users who open the DevTools, and the loss of privacy through disclosing that they opened DevTools looks negligible.
dg...@chromium.org
Andrey, did you work on css support in console? Any ideas?
bu...@chromium.org
The following revision refers to this bug:
http://src.chromium.org/viewvc/blink?view=rev&rev=197345
------------------------------------------------------------------
r197345 | lushnikov@chromium.org | 2015-06-18T11:47:53.921081Z
Changed paths:
Mhttp://src.chromium.org/viewvc/blink/trunk/LayoutTests/inspector/console/console-format-style-whitelist-expected.txt?r1=197345&r2=197344&pathrev=197345
Mhttp://src.chromium.org/viewvc/blink/trunk/LayoutTests/inspector/console/console-format-style-whitelist.html?r1=197345&r2=197344&pathrev=197345
Mhttp://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/console/ConsoleViewMessage.js?r1=197345&r2=197344&pathrev=197345
DevTools: [Console] filter out URLs from %c styling properties
Filter out properties from %c console message styling which value starts
with 'url('.
BUG=495643
R=pfeldman
Review URL:https://codereview.chromium.org/1191983002
-----------------------------------------------------------------
------------------------------------------------------------------
r197345 | lushnikov@chromium.org | 2015-06-18T11:47:53.921081Z
Changed paths:
M
M
M
DevTools: [Console] filter out URLs from %c styling properties
Filter out properties from %c console message styling which value starts
with 'url('.
BUG=495643
R=pfeldman
Review URL:
-----------------------------------------------------------------
co...@gmail.com
What about Base64 encoded images? With this fix that eliminates displaying any sort of image, even those created on the page. It breaks `console.snapshot` http://adriancooney.ie/console.snapshot/ (disclaimer: I'm the author).
ja...@chromium.org
Checking for values that begin "url(" is a little naive & can be worked around using console.log("%chello", "background-image: linear-gradient(to top, transparent, transparent), url('/foo.jpg')")
Also, I agree with #7, data: and blob: urls should be allowed here as they don't present a privacy risk.
If showing images in the console is considered ok, we could create a console.image(url) command that always loads the image, whether devtools is open or not, eliminating the privacy issue.
Also, I agree with #7, data: and blob: urls should be allowed here as they don't present a privacy risk.
If showing images in the console is considered ok, we could create a console.image(url) command that always loads the image, whether devtools is open or not, eliminating the privacy issue.
al...@chromium.org
[Empty comment from Monorail migration]
lu...@chromium.org
[Empty comment from Monorail migration]
sh...@chromium.org
A change has landed for this issue, but it's been open for over 6 months. Please review and close it if applicable. If this issue should remain open, remove the "Hotlist-OpenBugWithCL" label. If no action is taken, it will be archived in 30 days.
For more details visithttps://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
For more details visit
bu...@chromium.org
The following revision refers to this bug:
https://chromium.googlesource.com/chromium/src.git/+/d406a9cd13b766082e18656d38af20463150bde0
commit d406a9cd13b766082e18656d38af20463150bde0
Author: lushnikov <lushnikov@chromium.org>
Date: Mon Aug 01 21:23:51 2016
DevTools: [Console] revert filtering out URLs from %c styling properties
The patch reverts logic which filters URL's from %c styling properties.
(which was added incrrev.com/1191983002 )
The motivation behind this current implementation is naive and doesn't
address the issue.
BUG=495643
R=dgozman
Review-Url:https://codereview.chromium.org/2201913002
Cr-Commit-Position: refs/heads/master@{#409059}
[modify]https://crrev.com/d406a9cd13b766082e18656d38af20463150bde0/third_party/WebKit/LayoutTests/inspector/console/console-format-style-whitelist-expected.txt
[modify]https://crrev.com/d406a9cd13b766082e18656d38af20463150bde0/third_party/WebKit/LayoutTests/inspector/console/console-format-style-whitelist.html
[modify]https://crrev.com/d406a9cd13b766082e18656d38af20463150bde0/third_party/WebKit/Source/devtools/front_end/console/ConsoleViewMessage.js
commit d406a9cd13b766082e18656d38af20463150bde0
Author: lushnikov <lushnikov@chromium.org>
Date: Mon Aug 01 21:23:51 2016
DevTools: [Console] revert filtering out URLs from %c styling properties
The patch reverts logic which filters URL's from %c styling properties.
(which was added in
The motivation behind this current implementation is naive and doesn't
address the issue.
BUG=495643
R=dgozman
Review-Url:
Cr-Commit-Position: refs/heads/master@{#409059}
[modify]
[modify]
[modify]
lu...@chromium.org
As far as there are multiple different ways to detect opened devtools, (and we don't aim to fight with them ATM), closing this as WontFix.
pa...@chromium.org
[Empty comment from Monorail migration]
[Monorail components: Platform>DevTools>Authoring]
[Monorail components: Platform>DevTools>Authoring]
is...@google.com
This issue was migrated from crbug.com/chromium/495643?no_tracker_redirect=1
[Multiple monorail components: Platform>DevTools, Platform>DevTools>Authoring, Privacy, Security]
[Monorail components added to Component Tags custom field.]
[Multiple monorail components: Platform>DevTools, Platform>DevTools>Authoring, Privacy, Security]
[Monorail components added to Component Tags custom field.]
Description
This template is ONLY for reporting privacy issues. Please use a different
template for other types of bug reports.
Please seehttp://www.chromium.org/Home/chromium-privacy for further
information.
PRIVACY ISSUE
If using CSS is console.log() and a background-image is in use to a URL the console will fetch that URL once the user has opened up developer tools. With this a website could easily tell which users has opened the developer tools.
VERSION:
Chrome Version: 43.0.2357.81 (64-bit)
Operating System: OS X Yosemite 10.10.2
REPRODUCTION STEPS
Just putting the CSS in the console.log. Example from my website:
console.log('%cCookies', 'background-image: url("http://www.jsgraphs.com/cookies.jpg?v= ' + Math.random() + '"); font-size: 110px; color: transparent; background-repeat: no-repeat;');
The reason for the Math.Random() is so the image is not cached. A live example can be seen athttp://www.jsgraphs.com/ .
This is a security issue since the website can tell which users have opened up the developer console and can send analytic information along with a lot of other info about the user to the URL.