Bug 96559 – Web Inspector: information leak in JS console

• Status: RESOLVED
• Resolution: INVALID
• Component: Web Inspector (Deprecated)

[Thaddee Tyl]

How to reproduce:

1. Go to the following URL: data:text/html,<!doctype><title></title><script>window.eval = function (e) { console.log('sending ' + e + ' to a malicious website!'); };</script>
2. Open the JS console.
3. Enter something.

What happens:
The JS console is, in this case, rendered useless because it outputs

    sending with ((window && window.console && window.console._commandLineAPI) || {}) {
    something
    } to a malicious website!

With more malicious use of this issue, it could cause information leak from all developers on the website.

What should happen:
The JS console should execute the JS code entered in the console.

[Pavel Feldman]

1) we no longer use window's eval for it. See newer Canary / nightly
2) even when we did I don't see how that could be exploited

[Thaddee Tyl]

Outstanding!