1408018 - Should Browser Console execute code?

Status: RESOLVED INVALID

(DevTools :: Console, enhancement)

Description

[Andrea Marchesini [:baku]]

Browser console can be used to execute code at a chrome privilege level.
Since 57, addons cannot execute chrome code anymore but we still allow Browser Console to do it.
Wondering if we can block this and have the Browser Console just as a log viewer.

Note that we already have security issues: bug 1407740 and bug 1407751.

Comment 1

[Brian Grinstead [:bgrins]]

The input prompt is only available when devtools.chrome.enabled=true. Since that pref also allows the Browser Toolbox to be opened (where you can execute arbitrary chrome privileged code) I don't think there's a particular problem with allowing the Browser Console input as well. What do you think?

Comment 2

[Andrea Marchesini [:baku]]

(In reply to Brian Grinstead [:bgrins] from comment #1)
> The input prompt is only available when devtools.chrome.enabled=true. Since
> that pref also allows the Browser Toolbox to be opened (where you can
> execute arbitrary chrome privileged code) I don't think there's a particular
> problem with allowing the Browser Console input as well. What do you think?

I guess it's important to define the target of this feature: if it's used for internal development, it makes sense to keep this feature. Otherwise, having a way to run chrome code, especially after 57, seems not particularly useful.

Feel free to close this bug as INVALID if this is the case.

Comment 3

[Oriol Brufau [:Oriol]]

Why should the browser console stop being able to run code just because add-ons have been dumbified? I use it lots of times despite I have never created an add-on. And it's not like limiting the browser console would completely disable running privileged code. One could also use the web console in a privileged page, or Scratchpad. It would just be more annoying.

Comment 4

[J. Ryan Stinnett [:jryans] (Use needinfo, replies may be slow)]

When working on browser code, I regularly use the Browser Console to check state, try things, etc.  

So, I would hope to see this preserved, at least for local development.

Comment 5

[Brian Grinstead [:bgrins]]

(In reply to Andrea Marchesini [:baku] from comment #2)
> (In reply to Brian Grinstead [:bgrins] from comment #1)
> > The input prompt is only available when devtools.chrome.enabled=true. Since
> > that pref also allows the Browser Toolbox to be opened (where you can
> > execute arbitrary chrome privileged code) I don't think there's a particular
> > problem with allowing the Browser Console input as well. What do you think?
> 
> I guess it's important to define the target of this feature: if it's used
> for internal development, it makes sense to keep this feature. Otherwise,
> having a way to run chrome code, especially after 57, seems not particularly
> useful.
> 
> Feel free to close this bug as INVALID if this is the case.

Yeah, the primary target for the input field on the Browser Console is for Firefox development. Since the input field is hidden using the same pref that hide the Browser Toolbox and other chrome debugging tools, I don't think we need to make a special case here.