UnsafeWindow: Difference between revisions
m (→Attach script to page: Reinserting Yansky's sample code and marking as good) |
m (Matching to new template name) |
||
| Line 27: | Line 27: | ||
== Examples == | == Examples == | ||
{{Core | {{Core sample |1=<pre style="border: none; margin: inherit;"> | ||
unsafeWindow.SomeVarInPage = "Testing"; | unsafeWindow.SomeVarInPage = "Testing"; | ||
</pre>}} | </pre>}} | ||
{{Core | {{Core sample |1=<pre style="border: none; margin: inherit;"> | ||
unsafeWindow.SomeFunctionInPage("Test"); | unsafeWindow.SomeFunctionInPage("Test"); | ||
</pre>}} | </pre>}} | ||
{{Core | {{Core sample |1=<pre style="border: none; margin: inherit;"> | ||
var oldFunction = unsafeWindow.SomeFunctionInPage; | var oldFunction = unsafeWindow.SomeFunctionInPage; | ||
unsafeWindow.SomeFunctionInPage = function(text) { | unsafeWindow.SomeFunctionInPage = function(text) { | ||
| Line 54: | Line 54: | ||
Event listeners never need to be created on unsafeWindow. Rather than using | Event listeners never need to be created on unsafeWindow. Rather than using | ||
{{Bad | {{Bad sample|1=<pre style="border: none; margin: inherit;">unsafeWindow.onclick = function(event) { /* some code */ };</pre>}} | ||
use: | use: | ||
{{Good | {{Good sample|1=<pre style="border: none; margin: inherit;">window.addEventListener("click", function(event) { /* some code */ }, false);</pre>}} | ||
See also [http://developer.mozilla.org/en/docs/DOM:element.addEventListener addEventListener at MDC] | See also [http://developer.mozilla.org/en/docs/DOM:element.addEventListener addEventListener at MDC] | ||
| Line 66: | Line 66: | ||
If a user script must execute a page function, it can use the '''[[location hack]]''' to call it safely. This involves setting location.href to a <code>javascript:</code> URL, which is like using a bookmarklet. For example: | If a user script must execute a page function, it can use the '''[[location hack]]''' to call it safely. This involves setting location.href to a <code>javascript:</code> URL, which is like using a bookmarklet. For example: | ||
{{Fair | {{Fair sample|1=<pre style="border: none; margin: inherit;">location.href = "javascript:void(pageFunc(123));";</pre>}} | ||
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way: | Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way: | ||
{{Fair | {{Fair sample|1=<pre style="border: none; margin: inherit;">location.href = "javascript:(" + encodeURI(uneval(function() { /* some code */ })) + ")();";</pre>}} | ||
This code will run in the page context without leaking the [[sandbox]]. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function. | This code will run in the page context without leaking the [[sandbox]]. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function. | ||
| Line 81: | Line 81: | ||
==== Attach Method 1 ==== | ==== Attach Method 1 ==== | ||
{{Good | {{Good sample |1=<pre style="border: none; margin: inherit;"> | ||
function myScript() { | function myScript() { | ||
for (var x in document) { | for (var x in document) { | ||
| Line 105: | Line 105: | ||
==== Attach Method 2 ==== | ==== Attach Method 2 ==== | ||
{{Good | {{Good sample |1=<pre style="border: none; margin: inherit;"> | ||
window.addEventListener( | window.addEventListener( | ||
"DOMTitleChanged", | "DOMTitleChanged", | ||
| Line 138: | Line 138: | ||
==== Attach Method 3 ==== | ==== Attach Method 3 ==== | ||
Place this code at the very beginning of the script to inject the entire script into the page using the location hack. Like Attach Method 1, this will give the script access to variables on the page, but not access to Greasemonkey API methods. | Place this code at the very beginning of the script to inject the entire script into the page using the location hack. Like Attach Method 1, this will give the script access to variables on the page, but not access to Greasemonkey API methods. | ||
{{Fair | {{Fair sample|1=<pre style="border: none; margin: inherit;">if (typeof window.wrappedJSObject == "object") { | ||
location.href = "javascript:(" + encodeURI(arguments.callee.toSource()) + ")();"; | location.href = "javascript:(" + encodeURI(arguments.callee.toSource()) + ")();"; | ||
return; | return; | ||
| Line 153: | Line 153: | ||
* inject multiple .js files (even from different domains) | * inject multiple .js files (even from different domains) | ||
{{Fair | {{Fair sample|1=<pre style="border: none; margin: inherit;">/* Filename: hello-world.user.js */ | ||
inject_css(); | inject_css(); | ||
| Line 197: | Line 197: | ||
}</pre>}} | }</pre>}} | ||
{{Fair | {{Fair sample|1=<pre style="border: none; margin: inherit;">/* | ||
Filename: http://localhost:8080/hello-injecting.js | Filename: http://localhost:8080/hello-injecting.js | ||
or | or | ||
Revision as of 23:35, 6 May 2009
 Greasemonkey Manual |
| Using Greasemonkey |
|---|
| Installing Scripts |
| Monkey Menu |
| Getting Help |
| User Script Authoring |
| Editing |
| Environment |
| API |
This command can open certain security holes in your user script, and it is recommended to use this command sparingly.
Please be sure to read the entire article and understand it before using it in a script.
Description
This API object allows a User script to access "custom" properties--variable and functions defined in the page--set by the web page. The unsafeWindow object is shorthand for window.wrappedJSObject. It is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey sandbox.
- USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.
unsafeWindow bypasses Greasemonkey's XPCNativeWrapper-based security model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make greasemonkey scripts (which execute with more privileges than ordinary Javascript running in a web page) do things that their authors or users did not intend. User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow - especally if if they are executed for arbitrary web pages, such as those with @include *, where the page authors may have subverted the environment in this way.
User script authors are strongly encouraged to learn how XPCNativeWrappers work, and how to perform the desired function within their security context, instead of using unsafeWindow to break out.
Examples | Alternatives to unsafeWindow | Notes
Syntax
unsafeWindow
- Value: Object
- Returns: Variant
- Compatibility: Greasemonkey 0.5b+
Examples
- For issues with GM_getValue, GM_setValue and GM_xmlhttpRequest, see see 0.7.20080121.0_compatibility.
Alternatives to unsafeWindow
Events | Functions defined in the page | Attach script to page
Events
Event listeners never need to be created on unsafeWindow. Rather than using Template:Bad sample use: Template:Good sample
See also addEventListener at MDC
Functions defined in the page
If a user script must execute a page function, it can use the location hack to call it safely. This involves setting location.href to a javascript: URL, which is like using a bookmarklet. For example:
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:
This code will run in the page context without leaking the sandbox. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.
Another drawback is that this technique is rather ugly. Still, it is preferred over unsafeWindow.
Attach script to page
Attach Method 1
Attach Method 2
Attach Method 3
Place this code at the very beginning of the script to inject the entire script into the page using the location hack. Like Attach Method 1, this will give the script access to variables on the page, but not access to Greasemonkey API methods. Template:Fair sample Be very careful when using the wrappedJSObject property. It is just as dangerous as unsafeWindow is.
Attach Method 4
This way is interesting for those who want:
- execute the init() function NOT in GM address space
- inject multiple css hacks
- inject multiple .js files (even from different domains)
Attach Method 3 Pitfall 1
- The method of hosting hello-injecting.js on a local and remote web server was tested on:
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.7) Gecko/2009021906 Firefox/3.0.7
- and returned Component failure code with the following error:
- Error: Component returned failure code: 0x805e000a [nsIDOMLocation.href] = <unknown>
- Source file: file://~/.mozilla/firefox/{randomseed}.default/extensions/{class-id}/components/greasemonkey.js
- Line: 377
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.8) Gecko/2009032608 Firefox/3.0.8
- Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.8) Gecko/2009032608 Firefox/3.0.8
- and failed to execute init() with the following error:
- Error: init is not defined
- Source file: javascript:void(init());
- Line: 1
