71–80 of 90 posts
This is a pretty good reason to never trust Chrome again.
I wouldn't trust any computer, then. It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/
Earlier quoted context omitted.
Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter. javascript:alert('hi ' + document.body.innerHTML); If people can be tricked into executing code in the dev console, then…
Browsers have already started to remove/limit code execution capability from the address bar. https://bugzilla.mozilla.org/show_bug.cgi?id=656433 https://code.google.com/p/chromium/issues/detail?id=82181
Earlier quoted context omitted.
Browsers have already started to remove/limit code execution capability from the address bar. https://bugzilla.mozilla.org/show_bug.cgi?id=656433 https://code.google.com/p/chromium/issues/detail?id=82181
Wait does this mean bookmarklets will fail in those browsers from now on?
Earlier quoted context omitted.
Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
We can put bareers here forever that will deter more and more developers and curious yet-to-be hackers from playing with the web, while scammers will just use simple social tricks to make gullible people jump through any obstacle we put. Here, to be honest, I vote for natural selection. Fight the scammers, and let the gullible be scammed until the society develops an immune response. It happens all the times, and I t…
Earlier quoted context omitted.
We can put bareers here forever that will deter more and more developers and curious yet-to-be hackers from playing with the web, while scammers will just use simple social tricks to make gullible people jump through any obstacle we put. Here, to be honest, I vote for natural selection. Fight the scammers, and let the gullible be scammed until the society develops an immune response. It happens all the times, and I t…
How isn't this a type of immune response?
The accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?
The accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?
function escape(s) {
// Bonus level!
Object.defineProperty(console, 'foo',
{ get : function() { throw 'nooo!' } });
var code = 'with(window.console && console.foo || {}) {\n\t'+s+'\n}';
console.log(code);
try {
console.log(eval(code));
} catch (e) {
console.log(e);
}
}
Now, what brought me to the solution was this thought: "What in Javascript allows you to execute code before a given statement?" Upon framing it in this way, the solution became immediately clear: function declarations are automatically hoisted!
If you redefine `console` to be an object without the property 'foo', the `|| {}` part of the with predicate will instead be passed as the scope, and you have free reign to walk about the system.
So the solution is:
alert(1) } function console(){} {
with(window.console && console.foo || {}) {
alert(1) } function console(){} {
}The accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?
I spent a while looking at it last night and came up with a solution, I'll walk you through it. For reference, here's the code: function escape(s) { // Bonus level! Object.defineProperty(console, 'foo', { get : function() { throw 'nooo!' } }); var code = 'with(window.console && console.foo || {}) {\n\t'+s+'\n}'; console.log(code); try { console.log(eval(code)); } catch (e) { console.log(e); } } The idea is, you need…
Earlier quoted context omitted.
I wouldn't trust any computer, then. It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/
Exactly, how many developers can honestly say they've never copy pasted commands into the terminal without being 100% sure what they were doing?