Repository navigation
Gate CEF remote debugging behind an env var - #57
Merged
Merged
Conversation
The DevTools port 9222 was opened unconditionally in every shipped build, letting any local process attach to browser sources. It is now enabled only when OBS_BROWSER_REMOTE_DEBUGGING_PORT is set. Also drops per-message logging and the no-op ControlLevel switch around browser messaging. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 23, 2026
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for the changes making remote debugging opt-in and removing browser-message payload logging.
No open issues 🎉
What changed in this PR
This PR makes CEF remote debugging opt-in and removes browser-message logging that could expose message payloads in OBS logs.
Changes:
- Replaces the hard-coded DevTools port with
OBS_BROWSER_REMOTE_DEBUGGING_PORT, applied only to the browser process. - Removes per-message logs and simplifies the non-frontend-API message handler while preserving behavior.
- Applies formatting fixes in
obs-browser-source.cpp.
| File | Description |
|---|---|
obs-browser-source.cpp |
Removes outgoing message payload logging and fixes formatting. |
browser-client.cpp |
Removes incoming message logs and simplifies the control-level dispatch. |
browser-app.cpp |
Enables remote debugging when the environment variable is nonempty and derives the allowed origin from its value. |
Review effort: Balanced
sandboxcoder
approved these changes
Oct 28, 2026
summeroff
added a commit
to streamlabs/obs-studio
that referenced
this pull request
Oct 28, 2026
* Bump obs-browser to gate remote debugging behind an env var Picks up streamlabs/obs-browser#57: the DevTools port is no longer opened in shipped builds unless OBS_BROWSER_REMOTE_DEBUGGING_PORT is set. * Update obs-browser to streamlabs branch head
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every shipped build opened the CEF DevTools port 9222 (a leftover from debugging browser-source messaging in #44), so any local process could attach to browser sources and their logged-in pages.
OBS_BROWSER_REMOTE_DEBUGGING_PORTis set in the environment. Desktop/osn pass their environment to obs64, so set it before launching Desktop.[BrowserMessage]logs, which wrote message payloads into the OBS log.ControlLevelswitch in the non-frontend-API branch. Messaging was already allowed at every level, so behaviour is unchanged.obs-browser-source.cpp; the format check covers whole changed files.Tests
cmake --build build_x64 --config RelWithDebInfo --target obs-browser obs-browser-helper: OK (warnings as errors)ctest -R obs-browser: 1/1 passed