Difference between revisions of "UnsafeWindow"

From GreaseSpot Wiki
Jump to navigationJump to search
m (→‎Attach Method 1: Little more clarification here on what this does... executes in anonymous function.)
(→‎Functions defined in the page: show multi-line is allowed, and lessen code calls)
Line 70: Line 70:
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:


{{Fair samp |why=WARNING: Cross-platform Location hack failure |1=<pre style="border: none; margin: inherit;">location.href = "javascript:(" + encodeURI(uneval(function() { /* some code */ })) + ")();";</pre>}}
{{Fair samp |why=WARNING: Cross-platform Location hack failure |1=<pre style="border: none; margin: inherit;">location.href = "javascript:(" + function() {
 
/* Some code in here.
* Note that GM_ functions are not directly accessible in here.
*/
 
} + ")();";</pre>}}


This code will run in the page context without leaking the [[sandbox]]. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.
This code will run in the page context without leaking the [[sandbox]]. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.

Revision as of 02:10, 17 July 2009

Template:Lowercase

Book.png
Greasemonkey Manual
Using Greasemonkey
Installing Scripts
Monkey Menu
Getting Help
User Script Authoring
Editing
Environment
API

This command can open certain security holes in your user script, and it is recommended to use this command sparingly.

Please be sure to read the entire article and understand it before using it in a script.


Description

This API object allows a User script to access "custom" properties--variable and functions defined in the page--set by the web page. The unsafeWindow object is shorthand for window.wrappedJSObject. It is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey sandbox.

  • USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.

unsafeWindow bypasses Greasemonkey's XPCNativeWrapper-based security model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make greasemonkey scripts (which execute with more privileges than ordinary JavaScript running in a web page) do things that their authors or users did not intend. User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow - especally if if they are executed for arbitrary web pages, such as those with @include *, where the page authors may have subverted the environment in this way.

User script authors are strongly encouraged to learn how XPCNativeWrappers work, and how to perform the desired function within their security context, instead of using unsafeWindow to break out.

Examples | Alternatives to unsafeWindow | Notes

Syntax

unsafeWindow

Value: Object
Returns: Variant
Compatibility: Greasemonkey 0.5b+

top

Examples

Template:Core samp

Template:Core samp

Template:Core samp

For issues with GM_getValue, GM_setValue and GM_xmlhttpRequest, see see 0.7.20080121.0_compatibility.

top

Alternatives to unsafeWindow

Events | Functions defined in the page | Attach script to page

Events

Event listeners never need to be created on unsafeWindow. Rather than using Template:Bad samp use: Template:Good samp

See also addEventListener at MDC

top | back

Functions defined in the page

If a user script must execute a page function, it can use the location hack to call it safely. This involves setting location.href to a javascript: URL, which is like using a bookmarklet. For example:

Template:Fair samp

Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:

Template:Fair samp

This code will run in the page context without leaking the sandbox. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.

Another drawback is that this technique is rather ugly. Still, it is preferred over unsafeWindow.

top | back

Attach script to page

Attach Method 1

Template:Good samp

top | back

Attach Method 2

Template:Good samp

top | back

Attach Method 3

Place this code at the very beginning of the script to inject the entire script into the page using the location hack. Like Attach Method 1, this will give the script access to variables on the page, but not access to Greasemonkey API methods. Template:Fair samp Be very careful when using the wrappedJSObject property. It is just as dangerous as unsafeWindow is.

top | back


Notes

top