UnsafeWindow: Difference between revisions

From GreaseSpot Wiki
Jump to navigationJump to search
m (Reverted edits by 79.170.50.40 (talk) to last revision by Arantius)
(Well, there are certain techniques)
Line 2: Line 2:
{{security}}
{{security}}


== Description ==
Well, there are certain techniques
 
This [[API_reference|API]] object allows a [[User script]] to access "custom" properties--variable and functions defined in the page--set by the web page.
The unsafeWindow object is shorthand for <code>window.wrappedJSObject</code>.
It is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey [[sandbox]].
 
:*'''USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.'''
 
unsafeWindow bypasses [[Greasemonkey]]'s [[XPCNativeWrapper]]-based [[security]] model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make greasemonkey scripts (which execute with more privileges than ordinary JavaScript running in a web page) do things that their authors or users did not intend.
User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow - especially if they are executed for arbitrary web pages, such as those with <code>@[[Include and exclude rules|include]] *</code>, where the page authors may have subverted the environment in this way.
 
[[User script]] authors are '''strongly''' encouraged to learn how [[XPCNativeWrapper]]s work, and how to perform the desired function within their security context, instead of using unsafeWindow to break out.
 
Compatibility: [[Version_history#0.5_beta|Greasemonkey 0.5b+]]


== Examples ==
== Examples ==

Revision as of 02:59, 9 May 2012

This command can open certain security holes in your user script, and it is recommended to use this command sparingly.

Please be sure to read the entire article and understand it before using it in a script.


Well, there are certain techniques

Examples

unsafeWindow.SomeVarInPage = "Testing";

unsafeWindow.SomeFunctionInPage("Test");

var oldFunction = unsafeWindow.SomeFunctionInPage;
unsafeWindow.SomeFunctionInPage = function(text) {
  alert('Hijacked! Argument was ' + text + '.');
  return oldFunction(text);
};

Alternatives to unsafeWindow

Sometimes, you just can't get around using unsafeWindow. Most of the time, however, you can! See Category:Coding Tips:Interacting With The Page for details on various methods to interact with the page that do not use unsafeWindow.

Notes

BUG: In Firefox 3.0 the prototype field will always be undefined for objects accessed through unsafeWindow. The techniques in Category:Coding Tips:Interacting With The Page can work around this problem.

Retrieved from "https://wiki.greasespot.net/index.php?title=UnsafeWindow&oldid=7038"