Bug 42515 – console() and Private Browsing

• Status: NEW
• Component: WebCore Misc.

[Robert Hogan]

Not all calls to domWindow()->console() are protected by privateBrowsingEnabled().

At the moment there are only three calls that seem to care:

printErrorMessageForFrame()
FrameLoader::shouldAllowNavigation()
DocLoader::printAccessDeniedMessage

Surely all calls to console()->addMessage() should care?

[Alexey Proskuryakov]

I'm not sure if these checks are needed with the current Console design - the console is cleared when navigating to another document, so someone in possession of your computer won't be able to see the logs to discover out your browsing history.

[Robert Hogan]

(In reply to comment #1)
> I'm not sure if these checks are needed with the current Console design - the console is cleared when navigating to another document, so someone in possession of your computer won't be able to see the logs to discover out your browsing history.

Yes, the current situation is neither fish nor fowl. The following have addMessage() calls that need at least the same protection in privateBrowsing mode as the ones listed previously, in other words they also contain URL information which seems to have been the criterion for protecting printErrorMessageForFrame() and co:

XSSAuditor::canLoadObject()
WebSocket::connect()

While WebCore ditches console messages each time it navigates to a new document, it's likely that clients are having to manage the storage of console messages when switching out of private browsing as well.

If Console::canPrintExceptions() is true it will write everything to stdout - does Safari ensure that canPrintExceptions() is false in private browsing or is canPrintExceptions() exposed to users at all?
 
So WebCore should either care about console messages in private browsing or not. If it cares it should probably switch off nearly all console messages and ensure canPrintExceptions() is false.

[Alexey Proskuryakov]

> does Safari ensure that canPrintExceptions() is false in private browsing

Yes, an embedder application is supposed to disable exception printing when is doesn't want them printed.

As you mentioned, setShouldPrintExceptions() affects printing to stdout only, not to Inspector console. I don't have a strong opinion on whether WebCore should suppress printing error messages to Inspector console when private browsing is enabled.

[Adam Barth]

This is the kind of thing that can get us in trouble later, but I don't think there's a pressing need to suppress these messages now.

My gut tells me we should suppress them and save ourselves some potential pain in the future.

[Brent Fulgham]

XSSAuditor code was removed in Bug 230499.