Skip to content

Conversation

mdh1418
Copy link
Contributor

@mdh1418 mdh1418 commented Mar 4, 2024

When debugging blazorwasm applications using the BlazorDebugProxy, there are instances where the debugger itself hits an exception, such as attempting to evaluate an expression in the watch window when the debugger is paused. To capture how often users encounter such debugger exceptions, it would be helpful to send telemetry information for such events.

This PR looks to add a DotnetDebugger event listener to the Chrome DevTools Protocol (CDP) API, which upon hitting the event, the DapTelemetryReporter will send a telemetry report with an event name `blazor-debug/blazorDebugError'.

This PR does the following:

  • Creates a new CDP API endpoint for the DotnetDebugger exception event
  • Creates a new telemetry report classification for such exceptions
  • Adds the CDP event listener for blazor debugging while binding the debugger
  • Clean up typos and updates autogenerated files

Associated PR in dotnet/runtime: dotnet/runtime#99254

Testing

Built this repo locally
Built the runtime repo locally with changes in https://github.com/dotnet/runtime/pull/99254/files via ./build.sh -s mono+libs -os browser after having relevant dependencies installed
Created a new blazorwasm app with dotnet new blazorwasm
Added a target in blazorwasm app's csproj to replace runtime pack with locally built one

  <Target Name="UpdateRuntimePack" AfterTargets="ResolveFrameworkReferences">
    <ItemGroup>
      <ResolvedRuntimePack PackageDirectory="/Users/mitchellhwang/projects/runtime/artifacts/bin/microsoft.netcore.app.runtime.browser-wasm/Debug" Condition="'%(ResolvedRuntimePack.FrameworkName)' == 'Microsoft.NETCore.App'" />
    </ItemGroup>
  </Target>

Replaced the nuget package microsoft.aspnetcore.components.webassembly.devserver/<version>/tools/BlazorDebugProxy with locally built BrowserDebugHost artifact folder.
Ran the vscode-js-debug Extension configuration
Opened blazorwasm app with the new vscode window
Ran the blazorwasm app debugging
Added a breakpoint in Counter
Connected with BlazorDebugProxy
Navigated the blazorwasm app to the Counter page
Hit the set breakpoint
Added an expression in the watch window such as Math.PI
Checked telemetry database for the event.

src/binder.ts Outdated
Comment on lines 413 to 424
const isBlazor = 'inspectUri' in launchParams && !!launchParams.inspectUri;
if (isBlazor) {
const telemetryReporter = this._rootServices.get(ITelemetryReporter) as ITelemetryReporter;
const isVsCode = this._rootServices.get(IsVSCode);
cdp.DotnetDebugger.on('reportBlazorDebugError', event => {
telemetryReporter.report('blazorDebugError', {
exceptionType: event.exceptionType,
'!error': event.error,
error: isVsCode ? undefined : event.error,
});
});
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Eventually I was to have some kind of IDebuggerPlugin { register(thread, cdp, dap): void } interface, but for now can we toss this in its own small method or class?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved to event listener addition to a helper method. Is binder the right place?

I also added the condition to check if it was blazor debugging based on

const isBlazor = !!c.inspectUri;
, since otherwise it seemed like any other CDP connection would be able to emit the event and send a telemetry report.

@connor4312 connor4312 enabled auto-merge (squash) March 4, 2024 19:54
@vscodenpa vscodenpa added this to the March 2024 milestone Mar 4, 2024
@connor4312 connor4312 merged commit ec67074 into microsoft:main Mar 4, 2024
@Shygeek64
Copy link

J'ai besoin d'une aide secourable pour déboguer toutes mes pages web de vulnérabilités afin de passer au plan b: corriger mes vulnérabilités, j'en ai presque un millier depuis un bout de temps, voilà à quoi ressemble rien l'une d'entre elles:

<title>Document</title> <script src="script.js">let numberCve = prompt(CVE-2024-20419) console.log(CVE-2024-20419)</script> {"color="red"} {"bgcolor="midnight-blue"} {"font-size="30%"} {"align="center"} {"text="strong"} {"police-text="time-new-roman"}
    <p>Vector String CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
        Severity Score CVSS: Critical 10.0 By [email protected]</p>
        <h1>Name Of CWE: Unverified Password Change</h1>
        <h2>CWE ID: CWE-620</h2>
        <h3>Asset's Name Or Bug Bounty"s Prime: API For $990 000,00</h3>
        <h4>EPSS: 0,04%</h4>
        <h5>NVD Published Date: 17/07/2024</h5>
        <h6>NVD Last Modified: 13/08/2024</h6>
        <h7>Reported By Cisco System, Inc.</h7>
        <h8>Programmed By HackerOne</h8>
        <h9>To Share With NIST</h9>
    </header>
</body>

@Shygeek64
Copy link

Sur quoi dois-je appuyer pour déboguer mes pages web de vulnérabilités dans codespaces svp ? Et comment corriger les fautes d'écriture Web pour qu'on distingue mes langages de programmation: Je code en HTML, CSS et JavaScript et je ne vois pas en quels langages les associer, les balises, les accolades et les parenthèses, je ne sais rien de tout ça, je ne comprends pas

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants