UnsafeWindow: Difference between revisions
m categorized |
added addEventListener as an alternative to expandoing unsafeWindow |
||
| Line 22: | Line 22: | ||
= Alternatives to unsafeWindow = | = Alternatives to unsafeWindow = | ||
== Events == | |||
Event listeners never need to be created on unsafeWindow. Rather than using <code>unsafeWindow.onclick = function(event) { ... }</code>, use: | |||
window.addEventListener('click', function(event) { | |||
... | |||
}, false); | |||
[http://developer.mozilla.org/en/docs/DOM:element.addEventListener addEventListener at MDC] | |||
== Functions defined in the page == | |||
If a user script must execute a page function, it can use the '''location hack''' to call it safely. This involves setting location.href to a <code>javascript:</code> URL, which is like using a bookmarklet. For example: | If a user script must execute a page function, it can use the '''location hack''' to call it safely. This involves setting location.href to a <code>javascript:</code> URL, which is like using a bookmarklet. For example: | ||
Revision as of 17:54, 10 February 2007
This command can open certain security holes in your user script, and it is recommended to use this command sparingly.
Please be sure to read the entire article and understand it before using it in a script.
Syntax
unsafeWindow
Description
User scripts can use this object to access "custom" properties--variable and functions defined in the page--set by the web page. This is done by bypassing Greasemonkey's XPCNativeWrapper-based security model. unsafeWindow is shorthand for window.wrappedJSObject; it is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey sandbox.
unsafeWindow is insecure, and should be avoided when possible. User scripts absolutely should not use unsafeWindow if they are executed for arbitrary web pages, such as those with @include *.
Examples
unsafeWindow.document.title="Testing"
unsafeWindow.TestVarCreatedByDocument="Testing"
unsafeWindow.document.TestFunction("Test")
Alternatives to unsafeWindow
Events
Event listeners never need to be created on unsafeWindow. Rather than using unsafeWindow.onclick = function(event) { ... }, use:
window.addEventListener('click', function(event) {
...
}, false);
Functions defined in the page
If a user script must execute a page function, it can use the location hack to call it safely. This involves setting location.href to a javascript: URL, which is like using a bookmarklet. For example:
location.href = 'javascript:void(pageFunc(123));';
Larger blocks of code can also be executed this way:
location.href = 'javascript:(' + encodeURI(uneval(function() {
// some code
})) + ')();';
This code will run in the page context without leaking the sandbox. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.
Another drawback is that this technique is rather ugly. Still, it is preferred over unsafeWindow.
