Skip to content

Conversation

@CodeMonkeyCybersecurity
Copy link
Owner

Summary

  • Removed console method wrapping (wrapConsole()) from error-collector.js
  • Console wrapping violated UNIX Rule #8 (Build for Debuggability) and was an anti-pattern per TrackJS/OWASP guidance
  • Kept global error and unhandledrejection handlers as the only capture points

Root Cause

Console method wrapping (console.error = ...) was problematic because it:

  • Risks infinite recursion if error logging triggers another error
  • Breaks DevTools expectations (call stack, line numbers)
  • Adds performance overhead on every console call
  • Mutates global browser state

Changes

  • Deleted wrapConsole() method (~50 lines)
  • Deleted captureDebugLogs flag (unused without console wrapping)
  • Added documentation in CLAUDE.md explaining the security hardening
  • Created runbook docs/runbooks/RUNBOOK-error-collection.md documenting the simplified error collection approach

Test plan

  • npm test passes (310 tests)
  • Verified no console.error = or console.warn = assignments remain in .js files
  • Global error handlers still capture UNHANDLED_ERROR events
  • Global rejection handlers still capture UNHANDLED_REJECTION events
  • Console calls are no longer intercepted (by design)

🤖 Generated with Claude Code

Root cause: Console method wrapping violates UNIX Rule #8 (Build for
Debuggability) - it risks infinite recursion, breaks DevTools
expectations, adds performance overhead on every console call, and
mutates global browser state.

Solution: Rely on global error/rejection handlers only. The wrapConsole()
method and captureDebugLogs flag have been removed entirely. Unhandled
errors and promise rejections are still captured without intercepting
console.* methods.

Security posture is improved by avoiding interception of developer
tooling while still capturing actionable runtime failures.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants