0

Why is JavaScripts executed manually from the browser console not allowed to access "everything"? Especially the "visited" status (see this question) of links? What kind of security threat would that pose?

Usually, users have full access to their environment, sometimes with a little bump in the form of entering the root password or similar. Why is this an exception?

(I am not saying that scripts downloaded from a web page should have this access. I understand why that is a threat to the user's privacy etc.)

Improve this question
1
  • @MechMK1 It is NOT! Copy-pasted a little too quick. Fixed now.
    – d-b
    Dec 22, 2019 at 19:50

1 Answer 1

Reset to default
3

The answer to this is more regarding usability than it is security.

It's easier for the developers to build a box that does JavaScript, with rules and restrictions in place for what it is and is not allowed to do. You feed that box JavaScript code, and out comes the result of that code (plus side effects).

By implementing a feature like you suggested, you would introduce more complexity into that machine (and more possible surfaces for bugs), as now the machine would not only have to execute JavaScript, but also remember where that JavaScript came from, and what it is allowed to do.

Furthermore, it makes life for developers harder. Imagine typing a simple JavaScript command into your console, and it works, and when you then execute it from a script file, it suddenly does not work anymore. That can be incredibly frustrating for a developer to experience.

And finally, what is the upside? There is not really one. Manual JavaScript execution in a browser is an extremely niche feature 99.99% of browser users don't use. Even developers usually don't do that.

To summarize, this "feature" does not exist because:

  • It would introduce even more complexity (and thus more bugs)
  • It would confuse many developers
  • It would barely have any positives worth the cost
Improve this answer
4
  • I think more than 1 in 10 000 internet users use bookmarklets?
    – d-b
    Dec 22, 2019 at 19:48
  • @d-b Yes, I would argue so. That's an ancient technique, and frowned upon security-wise. The same thing can be achieved with a browser extension anyways.
    – user163495
    Dec 22, 2019 at 19:55
  • Can you suggest a solution to the linked question then? Extensions are way more complicated than bookmarklets.
    – d-b
    Dec 22, 2019 at 20:02
  • If you are referring to the question on StackOverflow, then no. And yes, they are, but bookmarklets were a hack anyways.
    – user163495
    Dec 22, 2019 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .