Location hack: Difference between revisions

From GreaseSpot Wiki
Jump to navigationJump to search
Ldrhcp (talk | contribs)
72 edits
wrote initial text. will fill in remaining sections later
 
remove obsolete content
 
(74 intermediate revisions by 18 users not shown)
Line 1: Line 1:
The '''location hack''' is an ugly but useful way to interact with the content scope of the page being [[user script]]ed.
The location hack is an older technique for crossing the barrier between the user script scope and the content window scope, when it exists.
The previous version of this page may be read [http://wiki.greasespot.net/index.php?title=Location_hack&oldid=7202 via history].


== Background ==
In Firefox version 39.0.3 Mozilla patched a known [https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ security vulnerability].
As a side effect, this broke the location hack.


For [[security]] reasons, [[Greasemonkey]] uses [[XPCNativeWrapper]]s and [[sandbox]] to isolate it from the web page. Under this system, the user script can access and manipulate the page using event listeners, the DOM API, and [[API reference|GM_* functions]].
Thankfully in modern versions of Firefox and Greasemonkey, the location hack is no longer necessary.
Read about how to execute code in the content scope, like previously possible with the location hack, at [[Content Script Injection]].


Sometimes the sandbox is too limiting, in which case the user script can access other parts of the page using [[unsafeWindow]]. As the name ''unsafe''Window implies, this can often be unsafe, and expose security holes.
[[Category:Coding Tips:Interacting With The Page]]
 
In December 2005, Jesse Ruderman [http://www.squarefree.com/2005/12/01/updated-greasemonkey-scripts/ came up with the location hack], to be an alternative to unsafeWindow in many cases.
 
== Basic usage: page functions ==
 
Suppose the page contains a function called <code>pageFunc</code>, or <code>window.pageFunc</code>. The user script knows this function as <code>unsafeWindow.pageFunc</code>.
 
The user script could simply call <code>unsafeWindow.pageFunc()</code>, but this can leak the sandbox. Instead, the user script can take advantage of javascript: URLs, which always run in the content scope. Just entering this URL into the browser's location bar does not leak a Greasemonkey sandbox:
 
javascript:void(pageFunc())
 
Similarly, a user script can set location.href to this URL to safely call the function:
 
location.href = "javascript:void(pageFunc())";
 
== Modifying the page ==
 
The location hack can do anything a page script or bookmarklet can do, so it can modify content variables and such as easily as it can access them. For example:
 
location.href = "javascript:void(window.someVariable = 'someValue')";
 
== Executing large blocks of code ==
 
== Returning values ==
 
{{stub}}

Latest revision as of 15:54, 23 September 2015

The location hack is an older technique for crossing the barrier between the user script scope and the content window scope, when it exists. The previous version of this page may be read via history.

In Firefox version 39.0.3 Mozilla patched a known security vulnerability. As a side effect, this broke the location hack.

Thankfully in modern versions of Firefox and Greasemonkey, the location hack is no longer necessary. Read about how to execute code in the content scope, like previously possible with the location hack, at Content Script Injection.

Retrieved from "https://wiki.greasespot.net/index.php?title=Location_hack&oldid=7458"