* SUMMARY Inspector Scripts evaluated in the page should not be searchable. * STEPS TO REPRODUCE 1. Inspect about:blank 2. Type "[1,2].con" in the console, to show autocompletion "concat" 3. Search "1,2" or "getComple" => results in Inspector internal script evaluated on the page to get completion for [1,2] * NOTES - The frontend ignores all evaluations containing a sourceURL starting with "__WebInspector", so we should append something like that for EVERY eval the frontend runs on the inspected page.
<rdar://problem/21413971>
Also affects DebuggerPopovers, and other one-off evaluations like "document". Basically all of these places can evaluate arbitrary code on the frontend: - RuntimeAgent.evaluate - DebuggerAgent.evaluateOnCallFrame - RuntimeAgent.callFunctionOn Both of these are wrapped by managers / models, others are called directly in code. I will just look at updating the direct call sites of each to ensure I cover each case.
Created attachment 254991 [details] [PATCH] Proposed Fix cq- for the moment because at least one part of this has yet to be tested manually by me.
Comment on attachment 254991 [details] [PATCH] Proposed Fix View in context: https://bugs.webkit.org/attachment.cgi?id=254991&action=review > Source/WebInspectorUI/UserInterface/Controllers/JavaScriptRuntimeCompletionProvider.js:159 > + else if (result.type === "string" || result.type === "number" || result.type === "boolean") { > + var completionScript = "(" + getCompletions + ")(\"" + result.type + "\")"; > + WebInspector.runtimeManager.evaluateInInspectedWindow(completionScript, "completion", false, true, true, false, false, receivedPropertyNamesFromEvaluate.bind(this)); > + } else Err, this change can be reverted now that I have evaluateInInspectedWindow add the sourceURL. Let me update the patch.
Created attachment 254992 [details] [PATCH] Proposed Fix
Comment on attachment 254992 [details] [PATCH] Proposed Fix Clearing flags on attachment: 254992 Committed r185638: <http://trac.webkit.org/changeset/185638>
All reviewed patches have been landed. Closing bug.