mozilla / codemoji

Mozilla Foundation project to support 2016 Encrypt campaign
Mozilla Public License 2.0
22 stars 19 forks source link

Key is revealed in debug console #226

Open Palciny opened 7 years ago

Palciny commented 7 years ago

Hi, I have created encoded message https://mzl.la/2yFqixl and looked to the developer console. I was surprised when I saw there key I have encrypted message with. storage is: Object { message: "πŸ­πŸ™†πŸŒ΄πŸš‚ πŸ’«πŸŒ΄πŸ’«πŸŒ΄ πŸš‚πŸ“£ πŸ’«πŸ“£πŸ’πŸ’«πŸŒ΄πŸŒπŸ‰πŸ‚πŸ’»πŸ‰ πŸ’β€πŸ’ΊπŸ‰πŸŒπŸ‰πŸ—Ύ πŸ πŸ’«πŸŒ΄πŸ’ΊπŸ‰ β›ͺπŸ˜„πŸ‘©πŸ“£ πŸŽ‰πŸ‰πŸ πŸŒ΄πŸ‘©πŸŒ΄πŸŒπŸ‰πŸš“πŸ‰πŸ™", key: "🍺" }

Than I have analyzed network activity and find out that https://codemoji.org/app.js?v=880.3432085551322

return function:

function r() {
        var e = d(), t = e.queryGet();
        !_.isEmpty(t) && t.data && (p = f(t.data), e.querySet({}), c(e.toString()), console.debug("storage is:", p))
    }

Problem is that console.debug("storage is:", p) is called in production.