Repository navigation
Fix security issues - #389
Merged
Vladimir Morozov (vmoroz) merged 1 commit intoOct 20, 2026
Merged
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
Elevated launches and debugger access controls need human review with Windows and browser integration validation.
No open issues 🎉
What changed in this PR
Hardens Windows tracing tool launches and access to the Hermes CDP debugger.
Changes:
- Resolves tracing executables from fixed trusted locations instead of PATH.
- Restricts debugger connections to loopback and approved browser origins.
- Adds security checks and documentation.
| File | Description |
|---|---|
| utils/tracing/win/TracingTools.ps1 | Adds trusted executable lookup and diagnostics. |
| utils/tracing/win/tests/Test-Tracing.ps1 | Tests trusted paths and mocked launches. |
| utils/tracing/win/Stop-Tracing.ps1 | Uses trusted recorder and analyzer paths. |
| utils/tracing/win/Start-Tracing.ps1 | Uses the trusted recorder path. |
| tools/hcdp/README.md | Documents connection restrictions and testing. |
| tools/hcdp/origin.test.js | Tests loopback binding and origin checks. |
| tools/hcdp/origin.js | Defines allowed origins and server options. |
| tools/hcdp/hcdp.js | Applies restricted server options. |
Review effort: Balanced
Vladimir Morozov (vmoroz)
enabled auto-merge (squash)
October 20, 2026 03:46
Khalef Hosany (Khalef1)
approved these changes
Oct 20, 2026
Benchmark ResultsTotal benchmarks: 204 Inputs: baseline/baseline.json, bench_result.json v8 (6176ms, 4993ms) -19.2%
test-suites (317886ms, 259453ms) -18.4%
micros (60876ms, 49234ms) -19.1%
jit-benches (8563ms, 5471ms) -36.1%
many-subclasses (73437ms, 61430ms) -16.3%
map-objects (3627ms, 2849ms) -21.4%
map-strings (4335ms, 3200ms) -26.2%
nbody (3448ms, 2397ms) -30.5%
string-switch (6503ms, 4524ms) -30.4%
raytracer (5608ms, 4413ms) -21.3%
MiniReact (30332ms, 22839ms) -24.7%
widgets (12934ms, 10150ms) -21.5%
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix two issues that an automated security scan reported in developer tools.
Neither tool is part of the shipped engine.
tools/hcdplistened on all interfaces and accepted any browser Origin. Whilea debug session was running, any open web page could connect, read the
debugged script and run code in its runtime. The server now listens on
127.0.0.1only and, during the handshake, rejects every browser Originexcept the DevTools frontend it opens. Native CDP clients that send no Origin
still work.
Start-Tracing.ps1andStop-Tracing.ps1runwpr.exeandwpa.exeas administrator after findingthem on PATH, so an executable planted earlier on PATH could be elevated. A
small shared helper now takes
wpr.exefrom the Windows system directory(falling back to the Windows Performance Toolkit folder) and
wpa.exefromthe WPT folder only, and passes the full path. PATH and the current
directory are ignored.
through PATH. The error message lists the supported folders.
that runs the real tracing scripts with decoy
wpr.exe/wpa.exeon PATH andin the current directory.
Start-Processis mocked, so nothing is launchedor elevated.
Test Plan
Run on Windows from the repository root:
Push-Location tools\hcdp; node --test; Pop-Location(afternpm ci):passed, 5/5. Real
wshandshakes: the frontend Origin and a missing Originare accepted; 9 bad Origins, including
nulland lookalike hosts, get 401and no connection is created.
pwsh -NoProfile -File utils\tracing\win\tests\Test-Tracing.ps1: passed onPowerShell 7.6.
powershell.exe -NoProfile -ExecutionPolicy Bypass -File utils\tracing\win\tests\Test-Tracing.ps1:passed on Windows PowerShell 5.1, both 64-bit and 32-bit (
SysWOW64).Not run: a manual DevTools session in Chrome/Edge and a real elevated WPR/WPA
trace. No C++ code changed, so there is no product build.
Microsoft Reviewers: Open in CodeFlow