UnsafeWindow: Difference between revisions

From GreaseSpot Wiki
Jump to navigationJump to search
(→‎Attach Method 2: @Flux: I'm unable to reproduce your desired results on this example... please correct the source code for this example (restored pitfalls too))
m (→‎Attach Method 2: Using hello-injecting.user.js will never work, so removed previous pitfall 1 and replaced 2 with 1... however notated this method works in win but not nix.. os x untested yet)
Line 139: Line 139:
/* Filename: hello-world.user.js */
/* Filename: hello-world.user.js */


(function()
inject_css();
{
  inject_css();
   
   
  /*
/*
    Define single/multiple script(s) to inject
  Define single/multiple script(s) to inject
      NOTES:
    NOTES:
        Schemes of file:// type, absolute or implied, are not supported with this method due to
      - Schemes of file:// type, absolute or implied, are not supported with this method due to
         browser security restrictions.
         browser security restrictions.
      - Schemes of http:// or https:// must be present
      - This method currently only works on Windows but not Linux (OS X untested)
        See pitfall 1 below
*/


        Schemes of http:// or https:// must be present, see pitfall 1 and 2 below.
var scripts = [
   */
  "http://localhost:8080/hello-injecting.js",
  "http://www.example.com/inject-this-script1.js",
   "http://www.example.com/inject-this-script2.js"
];


  var scripts = [
var script;
    "http://localhost:8080/hello-injecting.js",
for (i in scripts) {
    "http://www.example.com/inject-this-script1.js",
  script = document.createElement("script");
    "http://www.example.com/inject-this-script2.js"
  script.src = scripts[i];
  ];
  script.type = "text/javascript";


   var script;
   document.getElementsByTagName("head")[0].appendChild(script);
  for (i in scripts) {
}
    script = document.createElement("script");
    script.src = scripts[i];
    script.type = "text/javascript";
 
    document.getElementsByTagName("head")[0].appendChild(script);
  }
    
    
  window.addEventListener(
window.addEventListener(
    "load",
  "load",
    function(event) {
  function(event) {
      location.href = "javascript:void(init());";
    location.href = "javascript:void(init());";
    },
  },
    false
  false
  );
);
}
)();
 
   
   
   
   
Line 188: Line 184:
/*
/*
   Filename: http://localhost:8080/hello-injecting.js
   Filename: http://localhost:8080/hello-injecting.js
  NOTES:
    This means you are running your own web server on port 8080 and hosting this script locally and NOT remotely.
*/
*/


Line 201: Line 194:


===== Attach Method 2 Pitfall 1 =====
===== Attach Method 2 Pitfall 1 =====
:The method of hosting hello-injecting.user.js in Greasemonkey was tested on:
:The method of hosting hello-injecting.js on a local and remote web server was tested on:
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
:and ''failed to execute init()'' with the following error:
::Error: init is not defined
::Source file: javascript:void(init());
::Line: 1
:Possible solution:
:Always write the URL your .js file is in with the protocol as:


::* correct: http://localhost:8080/hello-injecting.user.js
::and ''returned Component failure code'' with the following error:
::* incorrect: localhost:8080/hello-injecting.user.js


:''NOTE:'' also check that the file is there.
:::Error: Component returned failure code: 0x805e000a [nsIDOMLocation.href] = <unknown>
:::Source file: file://~/.mozilla/firefox/randomseed.default/extensions/{class-id}/components/greasemonkey.js
:::Line: 377


===== Attach Method 2 Pitfall 2 =====
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.8) Gecko/2009032608 Firefox/3.0.8
:The method of hosting hello-injecting.js on a local web server as well as a remote web server was tested on:
::and ''failed to execute init()'' with the following error:
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6
::Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
:and ''returned Component failure code'' with the following error:


::Error: Component returned failure code: 0x805e000a [nsIDOMLocation.href] = <unknown>
:::Error: init is not defined
::Source file: file://~/.mozilla/firefox/randomseed.default/extensions/{class-id}/components/greasemonkey.js
:::Source file: javascript:void(init());
::Line: 377
:::Line: 1


== Notes ==
== Notes ==

Revision as of 07:17, 2 April 2009

Template:Lowercase

This command can open certain security holes in your user script, and it is recommended to use this command sparingly.

Please be sure to read the entire article and understand it before using it in a script.



Greasemonkey Manual
Using Greasemonkey
Installing Scripts
Monkey Menu
Getting Help
User Script Authoring
Editing
Environment
API

Description

This API object allows a User script to access "custom" properties--variable and functions defined in the page--set by the web page. The unsafeWindow object is shorthand for window.wrappedJSObject. It is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey sandbox.

  • USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.

unsafeWindow bypasses Greasemonkey's XPCNativeWrapper-based security model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make greasemonkey scripts (which execute with more privileges than ordinary Javascript running in a web page) do things that their authors or users did not intend. User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow - especally if if they are executed for arbitrary web pages, such as those with @include *, where the page authors may have subverted the environment in this way.

User script authors are strongly encouraged to learn how XPCNativeWrappers work, and how to perform the desired function within their security context, instead of using unsafeWindow to break out.

Examples | Alternatives to unsafeWindow | Notes

Syntax

unsafeWindow

Value: Object
Returns: Variant
Compatibility: Greasemonkey 0.5b+

top

Examples

unsafeWindow.SomeVarInPage = "Testing";
unsafeWindow.SomeFunctionInPage("Test");
var oldFunction = unsafeWindow.SomeFunctionInPage;
unsafeWindow.SomeFunctionInPage = function(text) {
  alert("Hijacked! Argument was " + text + ".");
  return oldFunction(text);
};
For issues with GM_getValue, GM_setValue and GM_xmlhttpRequest, see see 0.7.20080121.0_compatibility.
window.addEventListener(
  "DOMTitleChanged",
  function() {
    var redirectURL = window.name;
  },
  false
);

var sGetter = document.createElement("script");
sGetter.type = "text/javascript";
sGetter.innerHTML = 
  "function uXHR(url) {" +
  "  var xhr = new XMLHttpRequest();" +
  "  xhr.onreadystatechange = function() { " +
  "    if (xhr.status == 301 || xhr.status == 302) {" +
  "      window.name = xhr.getResponseHeader('Location');" +
  "      document.title = document.title;" +
  "    }" +
  "  };" +
  "  xhr.open('HEAD', url, true);" +
  "  xhr.send(null);" +
  "}";

document.body.appendChild(sGetter);

unsafeWindow.uXHR(url);

top

Alternatives to unsafeWindow

Events | Functions defined in the page | Attach script to page

Events

Event listeners never need to be created on unsafeWindow. Rather than using
unsafeWindow.onclick = function(event) { /* some code */ };

use:

window.addEventListener("click", function(event) { /* some code */ }, false);
See also addEventListener at MDC

top | back

Functions defined in the page

If a user script must execute a page function, it can use the location hack to call it safely. This involves setting location.href to a javascript: URL, which is like using a bookmarklet. For example:
location.href = "javascript:void(pageFunc(123));";
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:
location.href = "javascript:(" + encodeURI(uneval(function() { /* some code */ })) + ")();";
This code will run in the page context without leaking the sandbox. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.
Another drawback is that this technique is rather ugly. Still, it is preferred over unsafeWindow.

top | back

Attach script to page

Attach Method 1

function myScript() {
  for (var x in document) {
    // some code with x
  }
  // some code
}

// attach script to page; script can therefore reference variables on the page, but likewise
// cannot use greasemonkey API methods

document.body.appendChild(document.createElement("script")).innerHTML="(" + myScript + ")()";

top | back

Attach Method 2

This way is interesting for those who want:

  • execute the init() function NOT in GM address space
  • inject multiple css hacks
  • inject multiple .js files (even from different domains)
/* Filename: hello-world.user.js */

inject_css();
 
/*
  Define single/multiple script(s) to inject
    NOTES:
      - Schemes of file:// type, absolute or implied, are not supported with this method due to
        browser security restrictions.
      - Schemes of http:// or https:// must be present
      - This method currently only works on Windows but not Linux (OS X untested)
        See pitfall 1 below
*/

var scripts = [
  "http://localhost:8080/hello-injecting.js",
  "http://www.example.com/inject-this-script1.js",
  "http://www.example.com/inject-this-script2.js"
];

var script;
for (i in scripts) {
  script = document.createElement("script");
  script.src = scripts[i];
  script.type = "text/javascript";

  document.getElementsByTagName("head")[0].appendChild(script);
}
  
window.addEventListener(
  "load",
  function(event) {
    location.href = "javascript:void(init());";
  },
  false
);
 
 
function inject_css() {
  document.title += ' dynamically modified version';
  GM_addStyle("body { color:white; background-color:black } img { border:0 }");
}
/*
  Filename: http://localhost:8080/hello-injecting.js
*/

function init() {
  alert('Hello, world!');
}

top | back

Attach Method 2 Pitfall 1
The method of hosting hello-injecting.js on a local and remote web server was tested on:
Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6
Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
and returned Component failure code with the following error:
Error: Component returned failure code: 0x805e000a [nsIDOMLocation.href] = <unknown>
Source file: file://~/.mozilla/firefox/randomseed.default/extensions/{class-id}/components/greasemonkey.js
Line: 377
Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.8) Gecko/2009032608 Firefox/3.0.8
and failed to execute init() with the following error:
Error: init is not defined
Source file: javascript:void(init());
Line: 1

Notes

top