UnsafeWindow: Difference between revisions

From GreaseSpot Wiki
Jump to navigationJump to search
(Switbd like these posts most of all)
No edit summary
(5 intermediate revisions by 3 users not shown)
Line 2: Line 2:
{{security}}
{{security}}


Switbd like these posts most of all
== Description ==
 
This [object allows a [[User script]] to access "custom" properties set by the web page.
The user script is otherwise isolated from these properties.
 
:*'''USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.'''
 
unsafeWindow bypasses [[Greasemonkey]]'s security model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make user scripts (which execute with more privileges than ordinary JavaScript running in a web page) do things that their authors or users did not intend.
User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow - especially if they are executed for arbitrary web pages, such as those with <code>@[[Include and exclude rules|include]] *</code>..


== Examples ==
== Examples ==


<pre class='sample'>
<pre class='sample-bad'>
unsafeWindow.SomeVarInPage = "Testing";
unsafeWindow.SomeVarInPage = "Testing";
</pre>
</pre>


<pre class='sample'>
<pre class='sample-bad'>
unsafeWindow.SomeFunctionInPage("Test");
unsafeWindow.SomeFunctionInPage("Test");
</pre>
</pre>


<pre class='sample'>
<pre class='sample-bad'>
var oldFunction = unsafeWindow.SomeFunctionInPage;
var oldFunction = unsafeWindow.SomeFunctionInPage;
unsafeWindow.SomeFunctionInPage = function(text) {
unsafeWindow.SomeFunctionInPage = function(text) {
Line 27: Line 35:
Most of the time, however, you can!
Most of the time, however, you can!
See [[:Category:Coding Tips:Interacting With The Page]] for details on various methods to interact with the page that do '''not''' use unsafeWindow.
See [[:Category:Coding Tips:Interacting With The Page]] for details on various methods to interact with the page that do '''not''' use unsafeWindow.
== Notes ==
BUG: In Firefox 3.0 the <tt>prototype</tt> field will always be <tt>undefined</tt> for objects accessed through <tt>unsafeWindow</tt>.
The techniques in [[:Category:Coding Tips:Interacting With The Page]] can work around this problem.


[[Category:API_Reference|U]]  
[[Category:API_Reference|U]]  
[[Category:Scripting context]]
[[Category:Scripting context]]
[[Category:Security]]
[[Category:Security]]

Revision as of 20:17, 3 November 2017

This command can open certain security holes in your user script, and it is recommended to use this command sparingly.

Please be sure to read the entire article and understand it before using it in a script.


Description

This [object allows a User script to access "custom" properties set by the web page. The user script is otherwise isolated from these properties.

  • USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.

unsafeWindow bypasses Greasemonkey's security model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make user scripts (which execute with more privileges than ordinary JavaScript running in a web page) do things that their authors or users did not intend. User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow - especially if they are executed for arbitrary web pages, such as those with @include *..

Examples

unsafeWindow.SomeVarInPage = "Testing";
unsafeWindow.SomeFunctionInPage("Test");
var oldFunction = unsafeWindow.SomeFunctionInPage;
unsafeWindow.SomeFunctionInPage = function(text) {
  alert('Hijacked! Argument was ' + text + '.');
  return oldFunction(text);
};

Alternatives to unsafeWindow

Sometimes, you just can't get around using unsafeWindow. Most of the time, however, you can! See Category:Coding Tips:Interacting With The Page for details on various methods to interact with the page that do not use unsafeWindow.