Difference between revisions of "UnsafeWindow"
m (→Functions defined in the page: Restoring Ldrhcp's contrib to maintain page rank... Need a reason why a sample is "bad" if it should be removed... symmetry... contrib + sf)
|Line 158:||Line 158:|
== Notes ==
== Notes ==
Revision as of 06:01, 1 September 2009
|User Script Authoring|
This API object allows a User script to access "custom" properties--variable and functions defined in the page--set by the web page. The unsafeWindow object is shorthand for
window.wrappedJSObject. It is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey sandbox.
- USE OF UNSAFEWINDOW IS INSECURE, AND IT SHOULD BE AVOIDED WHENEVER POSSIBLE.
@include *, where the page authors may have subverted the environment in this way.
- Value: Object
- Returns: Variant
- Compatibility: Greasemonkey 0.5b+
- For issues with GM_getValue, GM_setValue and GM_xmlhttpRequest, see see 0.7.20080121.0_compatibility.
Alternatives to unsafeWindow
See also addEventListener at MDC
Functions defined in the page
If a user script must execute a page function, it can use the location hack to call it safely. This involves setting location.href to a
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:
Template:Fair samp or a more specific example:
This code will run in the page context without leaking the sandbox. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.
Another drawback is that this technique is rather ugly. Still, it is preferred over unsafeWindow.
Attach script to page
Attach Method 1
Attach Method 2
Attach Method 3
Place this code at the very beginning of the script to inject the entire script into the page using the location hack. Like Attach Method 1, this will give the script access to variables on the page, but not access to Greasemonkey API methods. Template:Fair samp Be very careful when using the wrappedJSObject property. It is just as dangerous as unsafeWindow is.
In Firefox 3.0 the prototype field will always be undefined for objects accessed through unsafeWindow.