Re: [Edbrowse-dev] js command line access

[Adam Thompson <arthompson1990@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1967 bytes --]

On Fri, Sep 25, 2015 at 12:55:47AM -0700, Kevin Carhart wrote:
> 
> >This is damn clever!
> 
> The idea is actually courtesy of Chris Brannon,
> because we were once emailing briefly about this thing
> called MozRepl.  I took it from there and found
> bits of javascript on that idea.  So thank you Chris!

Definitely, sounds seriously cool, I'm thinking in particular about when I
start playing with js engines etc, not to mention all the times when I wish for
an equivalent to the various developer consoles in other browsers.

> I know there are security issues, and you should
> not allow arbitrary strings to get run as code.

In this case I don't really see the security argument.
The user is typing in the js, so it's only as insecure as... say...
a shell or the like. As for the security of the site on the other end of the
connection, plenty of tools already exist (including extensions to the major
popular browsers I think) to mess with js behavior.

> I assumed this feature was too underground to mention,
> or I may have mentioned it sooner.  Grin.

Personally I'd document it. There's nothing worse than an undocumented feature
like this, that's one of the ways things fail to be maintained and security holes happen.
If it's there then not documenting it just means someone has to look at the
code, and if they're looking for exploits they'll do that anyway.

> We could use my code for this, but the output
> has not been edbrowzised or carved into lines.
> I don't bring it back into an edbrowse buffer.
> So the output could be a pain in the butt at
> the moment, but I could give you what I have
> and you could optimize it.
> It also depends on what you echo.

Fair enough, I say put it in and we'll run with it from there.

> Glad we might do this - it has certainly been
> invaluable for me,

Indeed. It also gives me some interesting ideas re:
using Edbrowse for page automation.

Cheers,
Adam.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]