UnsafeWindow: Difference between revisions

From GreaseSpot Wiki
Jump to navigationJump to search
m (lowercase title name template addition)
(→‎Description: Reworded, clarified, expanded)
Line 9: Line 9:
= Description =
= Description =


Userscripts can use this object to access document functions, variables and other elements in the document. unsafeWindow is a object wrapper for the entire document object.
[[User script]]s can use this object to access "custom" properties--variable and functions defined in the page--set by the web page. This is done by bypassing [[Greasemonkey]]'s [[XPCNativeWrapper]]-based [[security]] model. unsafeWindow is shorthand for window.wrappedJSObject; it is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey [[sandbox]].
 
unsafeWindow is insecure, and should be avoided when possible. User scripts absolutely should not use unsafeWindow if they are executed for arbitrary web pages, such as those with <code>@[[include]] *</code>.


= Examples =
= Examples =

Revision as of 02:13, 7 November 2006

Template:Lowercase

This command can open certain security holes in your user script, and it is recommended to use this command sparingly.

Please be sure to read the entire article and understand it before using it in a script.


Syntax

unsafeWindow

Description

User scripts can use this object to access "custom" properties--variable and functions defined in the page--set by the web page. This is done by bypassing Greasemonkey's XPCNativeWrapper-based security model. unsafeWindow is shorthand for window.wrappedJSObject; it is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey sandbox.

unsafeWindow is insecure, and should be avoided when possible. User scripts absolutely should not use unsafeWindow if they are executed for arbitrary web pages, such as those with @include *.

Examples

unsafeWindow.document.title="Testing"
unsafeWindow.TestVarCreatedByDocument="Testing"
unsafeWindow.document.TestFunction("Test")