1754141 - Instant evaluation: Bypass allowing JavaScript with side effects to be evaluated

Status: RESOLVED DUPLICATE of bug 1609432

(DevTools :: Console, defect, P2)

Description

[Kasper Karlsson]

Verified in Firefox 96.0.3

The "instant evaluation" feature of the Firefox browser console displays expression results immediately as they are entered. As a protection measure, impure expressions (which have side effects) are not allowed to execute. According to https://developer.mozilla.org/en-US/docs/Tools/Web_Console/The_command_line_interpreter#instant_evaluation

When the "instant evaluation" feature is enabled, the interpreter displays results of expressions as you're typing them in single-line mode. Note that the result might be an error message. Expressions that have side effects are not evaluated.

This protection can be bypassed, by using the functions Array.prototype.every() or Array.prototype.some()

Steps to reproduce:

1. Open the Firefox Developer Tools console
2. Enter the following text (either by pasting or writing manually) - this causes the impure alert function to be executed, with the obvious side effect of popping up an alert box:
   [1].every(alert)

Variations:
[1].every(aler\u0074)
[0].every(\u0061\u006c\u0065\u0072\u0074)
["Hello"].some(\u0061\u006c\u0065\u0072\u0074)

Comment 1

[:Gijs (he/him)]

Andrew, do you know if the JS team needs to look at this or if this is all devtools-based?

Comment 2

[Andrew McCreight [:mccr8]]

Looking at bug 1460518 and a few of the dependencies, it does appear that this feature required work in SpiderMonkey.

That being said, I don't think this is a security issue. If you can get a user to paste something in the browser console, you could probably also get them to paste something in the browser console and hit enter. Not evaluating expressions with side effects seems to be about making the feature nicer to use, not as a protection measure. There are a number of similar issues blocking bug 1460518 that are not security bugs. I'm not sure if this is a dupe of one of those or not. Therefore, I'm going to unhide this bug. Thanks for the report.

Comment 3

[Nicolas Chevobbe [:nchevobbe]]

Looks similar to Bug 1732543

Comment 4

[Julian Descottes [:jdescottes]]

Might be fixed by Bug 1732543, but keeping both open to check that both STRs are fixed and to add proper tests.

Comment 5

[Tooru Fujisawa [:arai]]

This case will be fixed by bug 1609432.