Repository navigation
Only enable CEF remote debugging when OBS_BROWSER_REMOTE_DEBUGGING_PORT is set - #58
Closed
nbarrett-logitech wants to merge 1 commit into
Closed
nbarrett-logitech wants to merge 1 commit into
nbarrett-logitech wants to merge 1 commit into
Conversation
…RT is set The remote-debugging-port and remote-allow-origins switches were appended unconditionally, so every browser source host exposed an unauthenticated DevTools endpoint on 127.0.0.1:9222 to any local process or account. Both switches are now added only when OBS_BROWSER_REMOTE_DEBUGGING_PORT holds a valid port number. The same port is used for the allowed origin.
Author
|
Closing as a duplicate of #57, which makes the same change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BrowserApp::OnBeforeCommandLineProcessingalways appendedremote-debugging-port=9222andremote-allow-origins=http://localhost:9222(added in #44). While any browser source is running, that leaves an unauthenticated DevTools endpoint on127.0.0.1:9222. Any other local process or account can list the pages and evaluate script in them, which exposes widget URLs, cookies andlocalStorage.Both switches are now only added when
OBS_BROWSER_REMOTE_DEBUGGING_PORTis set to a valid port (1-65535). The allowed origin uses the same port. With the variable unset, empty or invalid, nothing is opened, so release builds no longer listen.The panel's right-click "Inspect" item uses
ShowDevToolsin-process and is not affected.Notes
localhost:9222now needs to launch withOBS_BROWSER_REMOTE_DEBUGGING_PORT=9222.Testing
Not built locally (needs the libobs and CEF toolchain), relying on CI. To verify by hand: launch with the variable unset and confirm nothing listens on 9222, then set it to
9222and confirmhttp://127.0.0.1:9222/json/listresponds.