How to report possible security concern with firefox plugin?

24 Views Asked by At

I know this is an odd question to ask here - some might say its not the place to raise it but in the unlikely event that I am right, it could effect others who depend on this group. Basically a somewhat popular firefox plugin might have some undocumented and possibly unwanted features.

I use Firefox 47.0.1 on a Windows 7 environment with a couple of plugins as part of my WAMP environment. I use console.log generously, and noticed today (possibly since yesterday) that my console included the word "Testing" in the output. It did not attribute a source to it (typically on the right side of the console it will give me the script and a line number - it was just blank). The word "Testing" would appear at the same position, after a couple of my own functions had called. My entire javascript code base is near 4000 lines - I could not recall putting such words in, but as a precautionary measure, I copied it to a cygwin/*nix command line and searched grep -i "testing" through my scripts and did not find the word. I tried other creative ways to help me identify where it might be kicking in but failed.

I use Firefox profiles - one specifically for development that has the disk and memory cache disabled. I uninstalled the plugins, deleted the profile, then recreated the profile, re-ran my code.

My code run's as before with the exception that the "Testing" no longer appears within the console output.

Am I being paranoid? I cannot think of where the word "Testing" would come from. Nobody else has access to this laptop (trucrypted hard disk with 20character password, antivirus, not shared with anyone).

1

There are 1 best solutions below

1
On

You can use the browser toolbox to search through all loaded javascript code at runtime.

In case you have multi-process enabled you will also need to use the content process toolbox to search through javascript loaded into the child process.