6

I want to know if there is a way to check if a javascript function is being called from console of the browser or from source code.

I defined a function that can check if it's from console or from the page but it works only in google chrome, it doesn't work in firefox, I didn't test other browsers

function fromConsole()
{
    var Caller = arguments.callee.caller;
    while(Caller.caller != null)
        Caller = Caller.caller;
    return (Caller.toString().indexOf("function (expression, objectGroup,"))!=-1;
}

How this function works

this function looks for the top function that called our function. in google chrome the definition of the top function if its being called from console contains this string function (expression, objectGroup, in firefox, there is no function

Let me explain to you in details

let's say we have this example 

function a()
{
    b();
}
function b()
{
    return c();
}
function c()
{
    console.log(fromConsole());
}

If we call the function a() from the page , it shows in the console false (because the top function is a() ) however, if we call it from console it shows true, because the top function is this "function (expression, objectGroup,..."

In firefox, the top function is always a() wether you call your function from console or from your page

My question is : is there a way we can know if the function is called from console or not ?

Wladimir Palant
  • 56,865
  • 12
  • 98
  • 126
Khalid
  • 4,730
  • 5
  • 27
  • 50
  • I think "console.error('hello world')" maybe can help you. it will backtrace on browser like this: [screenshot](http://imgur.com/3AQ8Xtc) – tureki Jul 26 '14 at 02:13
  • In firefox it doesn't backtrace. and I need a function not something I can do manually – Khalid Jul 26 '14 at 03:20
  • 5
    What problem are you trying to solve? – Pointy Jul 26 '14 at 04:17
  • If you are trying to do some kind of of anti-cheating, Chrome allows the user to edit the JavaScript *in place* and thus could add a function call inside the code. There are proxies servers that can alter the script *in transit* as well. – Jeremy J Starcher Jul 26 '14 at 04:41

3 Answers3

15

In Chrome the console always calls intermediate JavaScript functions, in Firefox the call comes directly from native code. As a consequence, you can inspect arguments.callee.caller in Chrome but in Firefox it will always be null. Safari behaves the same as Firefox here, so inspecting the caller is really a trick that only works in Chrome.

What you can check nevertheless is Error.stack property. The following function works in Firefox, Chrome and even Safari:

function fromConsole()
{
    var stack;
    try
    {
       // Throwing the error for Safari's sake, in Chrome and Firefox
       // var stack = new Error().stack; is sufficient.
       throw new Error();
    }
    catch (e)
    {
        stack = e.stack;
    }
    if (!stack)
        return false;

    var lines = stack.split("\n");
    for (var i = 0; i < lines.length; i++)
    {
        if (lines[i].indexOf("at Object.InjectedScript.") >= 0)
            return true;   // Chrome console
        if (lines[i].indexOf("@debugger eval code") == 0)
            return true;   // Firefox console
        if (lines[i].indexOf("_evaluateOn") == 0)
            return true;   // Safari console
    }
    return false;
}

This will walk up the stack until it finds an entry corresponding to the console. This means that fromConsole() doesn't need to be called directly, there can be any number of other function calls in between. Still, it can easily be tricked, e.g. by using setTimeout():

setTimeout(fromConsole, 0);

Here the caller will be the native timeout handler, nothing pointing to the console any more.

Wladimir Palant
  • 56,865
  • 12
  • 98
  • 126
  • what i didn't understand is why `fromConsole` return `true` (in Firefox) if you call it inside the `setTimeout` and return false in chrome – Khalid Jul 28 '14 at 14:41
  • @Khalid: `setTimeout(function(){console.log(fromConsole())}, 0)` will still return `true` in Firefox because the caller is `function(){console.log(fromConsole())}` - that's an anonymous function created by the console, it also appears as `@debugger eval code` on the stack. But as I said, in `setTimeout(fromConsole, 0)` it will give you `false` in Firefox as well. – Wladimir Palant Jul 28 '14 at 19:07
  • does it mean that it's impossible to find out in all cases ?? – Khalid Jul 28 '14 at 19:09
  • @Khalid: That's what I said in my answer. If you run `setTimeout(fromConsole, 0);` from the console then the caller of your code isn't the console any more - `setTimeout` is. Same thing happens if somebody creates a ` – Wladimir Palant Jul 28 '14 at 19:23
  • setting up **event parameter** passing to the function being called... and then finding the _target_ who called _event_... `event.target` – Dev Matee Sep 26 '18 at 13:52
4

This is a cross-browser way of seeing if it was called from a public (global, called by js console), or a private (your code) context:

(function() { 
    window.f = function() {
        console.log('public')
    } ;
    //f will be this function in the rest of the code in this outer function:
    var f = function() {
        console.log('private'); 
    }
    f();
    //more code here...

}) ()

The code within the outer function will use the private function, while running f() from console will run the public function.

NoBugs
  • 9,310
  • 13
  • 80
  • 146
3

For Chrome, you could just check to see if the keys function is available. It's part of chrome's Command Line API and only available when the code was executed from the console

function myFunction() {
  var fromConsole = typeof keys === 'function' && keys.toString().indexOf('Command Line API') !== -1
  if (fromConsole) {
    alert('From console')
  } else {
    alert('Not from console')
  }
}
Sam Denty
  • 3,693
  • 3
  • 30
  • 43