[AI Assistance] Fail-closed origin locking in network and DOM tools Network tools (ListNetworkRequests, GetNetworkRequestDetails) previously checked if an origin lock was established, but fell back to allowing all requests when conversationOrigin was null or undefined, causing them to fail open. Similarly, DOM and accessibility tools (GetStyles, GetElementAccessibilityDetails, ResolveDevtoolsNodePath) relied on ConversationContext.isOriginAllowed(), which returns true when the origin lock is not established. This change migrates all remaining tools to isOriginAllowedByLock and ensures they fail closed when the origin lock is undefined or opaque: - ListNetworkRequestsTool and GetNetworkRequestDetailsTool reject execution when the origin lock is missing or opaque, and filter requests strictly via isOriginAllowedByLock against the initiator origin. - GetStylesTool, GetElementAccessibilityDetailsTool, and ResolveDevtoolsNodePathTool require an established non-opaque origin lock and validate target node origins using isOriginAllowedByLock. Fixed: 559156499 TAG=agy CONV=401d6ddf-8863-46c0-b0da-516acd8cbdda Change-Id: I281a52888fd35490ff11e96ac48bcdc6d49a6244 Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/8378726 Reviewed-by: Simon Zünd <szuend@chromium.org> Auto-Submit: Jack Franklin <jacktfranklin@chromium.org> Commit-Queue: Jack Franklin <jacktfranklin@chromium.org>
The client-side of the Chrome DevTools, including all TypeScript & CSS to run the DevTools webapp.
The frontend is available on chromium.googlesource.com. Check out the Chromium DevTools documentation for instructions to set up, use, and maintain a DevTools front-end checkout, as well as design guidelines, and architectural documentation.
DevTools frontend repository is mirrored on GitHub.
DevTools frontend is also available on NPM as the chrome-devtools-frontend package. It's not currently available via CJS or ES modules, so consuming this package in other tools may require some effort.
The version number of the npm package (e.g. 1.0.373466) refers to the Chromium commit position of latest frontend git commit. It's incremented with every Chromium commit, however the package is updated roughly daily.
There are a few options to keep an eye on the latest and greatest of DevTools development:
Follow What's new in DevTools.
Follow Umar's Dev Tips.
Follow these individual Twitter accounts: @umaar, @malyw, @kdzwinel, @addyosmani, @paul_irish, @samccone, @mathias, @mattzeunert, @PrashantPalikhe, @ziyunfei, and @bmeurer.
Follow to g/devtools-reviews@chromium.org mailing list for all reviews of pending code, and view the log, or follow @DevToolsCommits on Twitter.
Checkout all open DevTools tickets on crbug.com
Use Chrome Canary and poke around the experiments.