Security: Difference between revisions

From GreaseSpot Wiki
Jump to navigationJump to search
No edit summary
(see also with link)
Line 24: Line 24:
Its use has the potential to open up all the original security holes that introducing the [[XPCNativeWrapper]]s fixed.
Its use has the potential to open up all the original security holes that introducing the [[XPCNativeWrapper]]s fixed.
When a [[user script]] relies on the <code>unsafeWindow</code> property, it should be included only on trusted pages, and even then is not guaranteed to be safe.
When a [[user script]] relies on the <code>unsafeWindow</code> property, it should be included only on trusted pages, and even then is not guaranteed to be safe.
= See Also =
* [http://it.slashdot.org/article.pl?sid=05/07/19/143241 Slashdot: Firefox Greasemonkey Extension Security Problem]


{{stub}}
{{stub}}

Revision as of 22:44, 6 November 2006

Overview

Historically, Greasemonkey would inject a user script into a page by creating a <script> tag with the user script contents inline, and appending it to the content page's DOM.

Mark Pilgrim originally described a security flaw with this design, on July 19th 2005, while Greasemonkey was at version 0.3.4. Greasemonkey version 0.3.5 was immediately released, with all GM_* functions disabled, to plug the security hole. (Needed: more description of what the holes/problems were.)

To fix the security flaw, XPCNativeWrappers, a new feature of the then-in-development Firefox 1.5, were used to isolate privileged user script code from insecure content pages. Certain other changes were made, including restrictions on the GM_xmlhttpRequest method, to disallow access to local files.

unsafeWindow

Wrapping the user script environment this way creates a sandbox. This sandbox introduces many side effects and limitations. To allow maximum flexibility for user script authors, the unsafeWindow property was added in to the sandbox.

The window object functions as the global scope in javascript. For user scripts, this global window option is in fact a "deep wrapper" of the content window. The content window can be accessed by user scripts, but only indirectly through the wrapper. The unsafeWindow property is a direct line to the actual content window.

Use of the unsafeWindow property should be avoided whenever possible. Its use has the potential to open up all the original security holes that introducing the XPCNativeWrappers fixed. When a user script relies on the unsafeWindow property, it should be included only on trusted pages, and even then is not guaranteed to be safe.

See Also