1036109 - I can't paste anything into the web console.

Status: RESOLVED INVALID

(DevTools :: General, defect)

Description

[Jacques Uber [:uberj]]

Mozilla/5.0 (X11; Linux x86_64; rv:33.0) Gecko/20100101 Firefox/33.0

Steps to reproduce:
    * I open up a new ff instance
    * inspect element on the start up page
    * click "Console"
    * highlight some text (i.e. "Thanks for choosing Firefox")
    * attempt to paste it into the console
    * I get the "Scam Warning:..." alert box.

I get why you would want to disable this behavior (Self XSS) but this seems a little bit too much and does interfere with legitimate web dev use cases.

Comment 1

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

I forget who was doing this anti self-XSS, CC'ing people that might have been.

Comment 2

[Joe Walker [:jwalker]]

So far the STR is the expected results. There could be a bug here, maybe the paste warning is unclear, maybe it didn't turn off properly, but "it's annoying" isn't a bug - it is unfortunately by design.

In this situation "it's annoying" is a direct result of the desired outcome which is "it made me think". People are generally annoyed when they're forced to think, but forcing people to think is the only way to prevent them from being scammed.

Happy to re-open if there are problems with wording or it not actually turning off, but not happy to re-open because you're annoyed. Sorry!

Comment 3

[Jeff Griffiths (:canuckistani) (:⚡︎)]

Joe: weren't eventually going to turn this off for Aurora and Nightly though? I agree that this feature should be in release, but Beta/Aurora/Nightly are harder sells for me.

Comment 4

[Joe Walker [:jwalker]]

(In reply to Jeff Griffiths (:canuckistani) from comment #3)
> Joe: weren't eventually going to turn this off for Aurora and Nightly
> though? I agree that this feature should be in release, but
> Beta/Aurora/Nightly are harder sells for me.

We were and I'd still like to, but I think we should iron this type of thing out on Nightly/Aurora first.

I'd be very nervous about having a feature that was only tested in the wild on Release. I think we need it on Beta at the very least.

Comment 5

[Jeff Griffiths (:canuckistani) (:⚡︎)]

(In reply to Joe Walker [:jwalker] from comment #4)
...
> I'd be very nervous about having a feature that was only tested in the wild
> on Release. I think we need it on Beta at the very least.

Exactly - *eventually*.

Comment 6

[Jacques Uber [:uberj]]

Is there any way to expose the exact reasons why you can't paste when the spam warning comes up? The reasons :jwalker outlined in this bug (and on IRC) are all good reasons for why the no-paste feature was added. Maybe an <a> tag in the spam warning that links to a page that outlines the reasons?

Comment 7

[g7520789]

>it's annoying

It prevents me from doing what I want to do. Firefox requires me to enter a ritual string instead of doing what it's expected to do. It not only wastes my time and humiliates me, in some cases it's not so easy to enter the required string because it's in some national language. Try to enter "разрешить вставку".

Moreover, entered string remains after unlocking the console. It makes me to feel like I was used and left alone to deal with consequences.

Comment 8

[boban.stojanovski]

wtf guys ... this is beyond stupid.
Dev tools in FF is a disaster.

Comment 9

[jezed]

This has to be the most disastrous, developer-insulting "feature" to ever come across on a major browser. What were any of you thinking when you had this idea? What were you actually trying to accomplish? I simply cannot believe the levels of wrong done to have this botched excuse of an implementation available on an official, out-of-beta release.
First of all, it's a huge slap in the face of a developer to have (most likely) their own (test case) code being prevented from running on the console for a reason that essentially applies to NON-DEVELOPERS, as they are precisely the sort of people who should not delve into the developer tools in the first place. At this point the developer is sort of annoyed, but not before they realize they're forced to type a specific string, as if to coax them to imagine they're playing text-based adventure games! And this string differs from language to language! I wonder how many people you managed to get to translate "allow pasting" into the many different languages out there, as if a developer (working with English-based programming keywords) would care!
Secondly, this bug successfully manages to insult the developer by implying they'll easily fall for a trick they can easily avoid by reading (and, if necessary, beautify) the code of unknown source (as you're aware, developers read code more than they write it), while also completely missing the intended target (non-developer user), because, as stated above, non-developers have little reason to open the developer tools. This warning can simply be shown somewhere else a normal user would regularly frequent (any place that is NOT the developer tools), while allowing developers to do their thing without wasting their time by disturbing and annoying them.
Thirdly, it's very hard to come up with a successful excuse for an implementation that is based on patronizing the developer and holding the user's fragile baby hands. It's entirely out of relevance if the intention was for their own good, as the intended target has already been pestered and will most likely skim through the entire message or completely ignore it, which is precisely the opposite of the desired outcome! So now you end up with an user that completely skipped the whole message, and a developer who is wasting their time trying to find out how to remove this dreaded annoyance!
This seriously makes me question the underlying purpose of the developers assigned to implement the bug and the process they've gone through for a vast period of time without bringing it into heavy scrutinization. I am beginning to wonder if there is a greater force at hand or if the people involved actually possess the required competence to continue working on features supposed to be launched onto official releases.