|
|
| Line 1: |
Line 1: |
| == GM_eval vs. eval(s, unsafeWindow) vs. LocationHack == | | == GM_eval vs. eval(s, unsafeWindow) vs. LocationHack == |
|
| |
|
| JavaScript in Mozilla/Gecko/Firefox is currently implemented by the [http://developer.mozilla.org/en/docs/SpiderMonkey SpiderMonkey engine written in C]. It implements an [http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Functions:eval eval] function that takes an optional second argument to give the scope or context for the <code>eval</code>.
| | <code>GM_eval()</code> will not be implemented. |
| eval(string[, object])
| |
| It seems the two-argument <code>eval</code> can do all or more than the ''location-hack''.
| |
|
| |
|
| The main question is how secure it is in terms of giving a web page control over a browser. (Note that there are problems with this issue but particulars are purposefully rarely mentioned).
| | # [https://developer.mozilla.org/en/Core_JavaScript_1.5_Reference/Global_Functions/eval#Cross-implementation_compatibility The second argument of eval was removed]. |
| I can't see how a JS statement like the following could leak any GM access to a web page.
| | # Running <code>eval()</code> in chrome scope is a very dangerous thing to do. |
| eval(s, unsafeWindow);
| | # I'm not confident that it actually worked to solve the problems that the location hack does. (I'm confident that it does not, on FF 3.0.13 on Linux. Perhaps it did in older versions, before it was removed.) |
| But then, the following might be unsafe, particularly if <code>r</code> is later stored somewhere or more particularly if <code>r</code> gets some methods invoked off of it:
| |
| var r = eval(s, unsafeWindow);
| |
| | |
| The obvious solution to make <code>r</code> safe from potential terrors is to wrap it in a [http://developer.mozilla.org/en/docs/XPCNativeWrapper XPCNativeWrapper] just like GreaseMonkey does.
| |
| r = new XPCNativeWrapper(eval(s, unsafeWindow));
| |
| | |
| === Objections to: eval(s, unsafeWindow) ===
| |
| * It is not as obfuscated as sending the string <code>'javascript:...'</code> to <code>location.href</code> and is thus not as '''cool'''.
| |
| * 2-argument <code>eval</code> is not standard JavaScript
| |
| ** While the '''true GreaseMonkey''' is based on Mozilla code, there are several other implementations for different browsers with different script engines, and those might not implement 2-argument <code>eval</code>.
| |
| ** Mozilla JavaScript is considering and may migrate to to standards such as [http://developer.mozilla.org/en/docs/E4X ECMAScript for XML (E4X)] and/or go to the open source [http://www.mozilla.org/projects/tamarin/ Tamerin engine] which Adobe wants. These new versions of JavaScript might not implement 2-argument eval (though I doubt it).
| |
| * Script writers who directly use <code>eval</code> may break security unless they take the extra step to wrap the result.
| |
| | |
| === Advantages of: eval(s, unsafeWindow) ===
| |
| * It is less verbose than the location hack. You don't have to wrap strings in things like
| |
| javascript:void(...)
| |
| * It permits returning a value in a way that the target page cannot detect.
| |
| * You don't have to worry whether you need to [http://wiki.greasespot.net/index.php?title=Location_hack&action=submit#Percent_encoding_issue encode special characters] like with the ''location-hack''.
| |
| | |
| === GM_eval ===
| |
| To resolve this distinction I propose that the GM API include the function GM_eval. In Mozilla GreaseMonkey it is just defined as something like
| |
| function GM_eval (string) {return new XPCNativeWrapper(eval(string, unsafeWindow));
| |
| For other browsers/script-engines that don't have 2-argument eval one might want to make it a 2-argument function:
| |
| GM_eval(string, [boolean]);
| |
| that uses the ''location-hack'' and wraps and encodes the string appropriatly. If the second argument is ''true'' then that means the function should use some detectable means to record the result inside the target document and return it or just possibly complain with a security error. | |
| ==== Advantages: ====
| |
| * Using <code>GM_eval</code> semantically indicates that you are safely evaluating something on the target page as opposed to going through some hack back door.
| |
| * You don't need to extra wrap or encode things like for the ''location-hack''.
| |
| * <code>GM_eval</code> would really simplify the documentation of GreaseMonkey. For example this page would disappear. There would be one page on <code>GM_eval</code> that explains what it means and how it can be imlemented through <code>eval</code> or the ''location-hack'', and most of the other stuff on this page could go into "code snippits". [Though I have noticed some other references to ''location-hack'' that should be cleaned up]
| |
| ==== Disadvantages ====
| |
| None seen so far other than increasing the API count by one.
| |
|
| |
|
| == Location Hack Broken == | | == Location Hack Broken == |
GM_eval vs. eval(s, unsafeWindow) vs. LocationHack
GM_eval() will not be implemented.
- The second argument of eval was removed.
- Running
eval() in chrome scope is a very dangerous thing to do.
- I'm not confident that it actually worked to solve the problems that the location hack does. (I'm confident that it does not, on FF 3.0.13 on Linux. Perhaps it did in older versions, before it was removed.)
Location Hack Broken
-Removed-
Fromp: You are confused about what the location hack is supposed to accomplish.
It's for letting a user script call into a function (for example) defined in the page.
Your example which I just removed was doing the opposite.
As written that example should never have worked.
Arantius 12:41, 16 September 2009 (EDT)
