Recent changes to XPCNativeWrapper

XPCNativeWrapper modified by mmartz

mmartz — Fri, 09 Aug 2019 19:34:01 -0000

--- v5
+++ v6
@@ -1,5 +1,5 @@
 [toTop]: #content_base "Top"
-[toBottom]: #site-footer "Bottom"
+[toBottom]: #notes "Bottom"

 ## Overview

@@ -155,3 +155,7 @@
 ~~~~~~    

 Any Greasemonkey script written before version 0.5 was released in mid-2005 may need updating to use [addEventListener](https://developer.mozilla.org/en-US/docs/Web/API/EventTarget.addEventListener). 
+
+## Notes
+
+[⬆][toTop]

XPCNativeWrapper modified by Martz

Martz — Sun, 10 Aug 2014 07:41:48 -0000

--- v4
+++ v5
@@ -39,8 +39,8 @@
 Bad sample:

 ~~~~~~
-    var el = document.createElement("a");
-    el.onclick = "alert('Error'); return false;";
+var el = document.createElement('a');
+el.onclick = 'alert("Error"); return false;';
 ~~~~~~

 Instead, use [setAttribute](https://developer.mozilla.org/docs/Web/API/element.setAttribute) and [addEventListener](https://developer.mozilla.org/docs/Web/API/EventTarget.addEventListener) methods. Note the use of the [preventDefault](https://developer.mozilla.org/docs/Web/API/event.preventDefault) method to emulate the "return false" behavior above. 
@@ -86,7 +86,7 @@
 Instead use this... 

 ~~~~~~
-var arInputs = document.getElementsByTagName("input");
+var arInputs = document.getElementsByTagName('input');

 var elmInput;
 for (var i = arInputs.length - 1; i >= 0; --i) {
@@ -113,7 +113,7 @@
 Instead use this... 

 ~~~~~~
-form.elements.namedItem("foo");
+form.elements.namedItem('foo');
 ~~~~~~    

 The same goes for frames: 
@@ -127,7 +127,7 @@
 Instead use this... 

 ~~~~~~    
-window.frames["framename"];
+window.frames['framename'];
 ~~~~~~    

@@ -144,14 +144,14 @@
 or 

 ~~~~~~
-    element.onclick = "myClickHandler(this)";
+    element.onclick = 'myClickHandler(this)';
 ~~~~~~

 This does not work on XPCNativeWrappers; it will result in a `Component not available` error in the JavaScript console. Instead, use `addEventListener`

 ~~~~~~
-    element.addEventListener("click", myClickHandler, false);
+    element.addEventListener('click', myClickHandler, false);
 ~~~~~~    

 Any Greasemonkey script written before version 0.5 was released in mid-2005 may need updating to use [addEventListener](https://developer.mozilla.org/en-US/docs/Web/API/EventTarget.addEventListener).

XPCNativeWrapper modified by Martz

Martz — Sun, 10 Aug 2014 07:38:21 -0000

--- v3
+++ v4
@@ -119,6 +119,7 @@
 The same goes for frames:

 Bad sample
+
 ~~~~~~
 window.framename;
 ~~~~~~
@@ -135,9 +136,11 @@
 Normal JavaScript can access an element's event handlers with code like: 

 Bad samples:
+
 ~~~~~~
 element.onclick = myClickHandler;
 ~~~~~~
+
 or 

 ~~~~~~

XPCNativeWrapper modified by Martz

Martz — Sun, 10 Aug 2014 07:36:42 -0000

--- v2
+++ v3
@@ -96,96 +96,59 @@
 }
 ~~~~~~

-or 
-
-~~~~~~
-var arInputs = document.getElementsByTagName("input");
-
-for each(var elmInput in arInputs) {
-  /* some code */
-}
-~~~~~~
-
 ### Named Items

 Items like frames, form elements, and so on can be referenced by name in normal JavaScript. 

-XPCNativeWrappers cannot reference items by name. Use the 
-    
-    namedItem
+XPCNativeWrappers cannot reference items by name. Use the `namedItem` method.

-method. With a 
-    
-    <input name="foo">
+With a `` in the form:

-in the form: {{Bad samp |1=
-    
-    form.foo;
+Bad sample:

-}} 
+~~~~~~
+form.foo;
+~~~~~~

 Instead use this... 

-{{Good samp |1=
-    
-    
-    form.elements.namedItem("foo");
-    
-
-}} 
+~~~~~~
+form.elements.namedItem("foo");
+~~~~~~    

 The same goes for frames: 

-{{Bad samp |1=
-    
-    window.framename;
-
-}} 
+Bad sample
+~~~~~~
+window.framename;
+~~~~~~

 Instead use this... 

-{{Good samp |1=
-    
-    
-    window.frames["framename"];
-    
+~~~~~~    
+window.frames["framename"];
+~~~~~~    

-}}} 
-
-[X](Category:Security) [Category:Scripting_context] 

 ### Event Handlers

 Normal JavaScript can access an element's event handlers with code like: 

-{{Bad samp |1=
-    
-    element.onclick = myClickHandler;
-
-}} 
-
+Bad samples:
+~~~~~~
+element.onclick = myClickHandler;
+~~~~~~
 or 

-{{Bad samp |1=
-    
+~~~~~~
     element.onclick = "myClickHandler(this)";
+~~~~~~

-}} This does not work on XPCNativeWrappers; it will result in a 
-    
-    Component not available

-error in the JavaScript console. Instead, use 
-    
-    addEventListener
+This does not work on XPCNativeWrappers; it will result in a `Component not available` error in the JavaScript console. Instead, use `addEventListener`

-: {{Good samp |1=
-    
-    
+~~~~~~
     element.addEventListener("click", myClickHandler, false);
-    
+~~~~~~    

-}} 
-
-Any Greasemonkey script written before version 0.5 was released in mid-2005 may need updating to use addEventListener. 
-
-  * [https://developer.mozilla.org/En/DOM/Element.addEventListener](http://developer.mozilla.org/En/DOM/Element.addEventListener)
+Any Greasemonkey script written before version 0.5 was released in mid-2005 may need updating to use [addEventListener](https://developer.mozilla.org/en-US/docs/Web/API/EventTarget.addEventListener).

XPCNativeWrapper modified by Martz

Martz — Sun, 10 Aug 2014 07:31:09 -0000

--- v1
+++ v2
@@ -1,29 +1,34 @@
-[TOC]
+[toTop]: #content_base "Top"
+[toBottom]: #site-footer "Bottom"

 ## Overview

 Most all objects on a target web page that a user script sees are wrapped in [XPCNativeWrapper](http://developer.mozilla.org/en/docs/XPCNativeWrapper). The reason for this is so that a script can change the properties of an object (actually the wrapper) without any JavaScript on the target page being able to see it. Mostly the wrapping is "transparent" - wrapped and unwrapped objects seem to behave the same because the wrapping object passes methods to the wrapped object, though there are some some exceptions. 

+[⬆][toTop] [⬇][toBottom]
+
 #### wrappedJSObject

 For a script to access the real underlying object there is the method 

-{{Fair samp |why=Potential danger if a constructor init is called |1=
-    
-    
-    var realObj = wrappedObj.wrappedJSObject;
-    
+Fair sample:

-}} 
+~~~~~~
+var realObj = wrappedObj.wrappedJSObject;
+~~~~~~

-**Be very careful when using the wrappedJSObject property. It is just as dangerous as [UnsafeWindow] is.**
+**Be very careful when using the wrappedJSObject property. It is just as dangerous as [unsafeWindow](unsafeWindow) is.**
+
+[⬆][toTop] [⬇][toBottom]

 #### Security

-Related to [Security]. 
+Related to [security](Security). 

   * http://kb.mozillazine.org/XPCNativeWrapper 
-  * http://developer.mozilla.org/en/docs/XPCNativeWrapper 
+  * https://developer.mozilla.org/docs/Xray_vision
+
+[⬆][toTop] [⬇][toBottom]

 ## Limitations / Problems

@@ -31,102 +36,75 @@

 [Expando_Properties] do not work on XPCNativeWrappers. This means that, for example, this will not work: 

-{{Bad samp |1=
-    
+Bad sample:
+
+~~~~~~
     var el = document.createElement("a");
     el.onclick = "alert('Error'); return false;";
-    
+~~~~~~

-}} 
-
-Instead, use [setAttribute](Mdc:DOM:element.setAttribute) and [addEventListener](Mdc:DOM:element.addEventListener) methods. Note the use of the [preventDefault](Mdc:DOM:event.preventDefault) method to emulate the "return false" behavior above. 
+Instead, use [setAttribute](https://developer.mozilla.org/docs/Web/API/element.setAttribute) and [addEventListener](https://developer.mozilla.org/docs/Web/API/EventTarget.addEventListener) methods. Note the use of the [preventDefault](https://developer.mozilla.org/docs/Web/API/event.preventDefault) method to emulate the "return false" behavior above. 

 addEventListener example: 

-{{Good samp |1=
+

+~~~~~~
+function showTheError(event) {
+  event.preventDefault();

-    function showTheError(event) {
-        event.preventDefault();
-    
-        /* some code */
-    }
-    var el = document.createElement("a");
-    el.addEventListener("click", showTheError, false);
-    
+  /* some code */
+}

-}} 
+var el = document.createElement('a');
+el.addEventListener('click', showTheError, false);
+~~~~~~

 setAttribute example: 

-{{Good samp |1=
-    
-    
-    var el = document.createElement("a");
-    el.setAttribute("onclick", "alert('Error'); return false;");
-    
+~~~~~~
+var el = document.createElement('a');
+el.setAttribute('onclick', 'alert("Error"); return false;');
+~~~~~~

-}} This applies to any element, not just new ones you create (those references from 
-    
-    createElement
-
-and those from 
-    
-    getElementById
-
-et al), and any event handler, not just onclick. 
+ This applies to any element, not just new ones you create (those references from `createElement` and those from `getElementById`, and any event handler, not just onclick. 

 ### for ... in on HTMLCollections

-DOM methods like 
+DOM methods like `getElementsByTagName` return `HTMLCollection`s.
+
+Bad sample:
+
+~~~~~~
+var arInputs = document.getElementsByTagName('input');

-    getElementsByTagName
-
-return 
-    
-    HTMLCollection
-
-s. {{Bad samp |1=
-    
-    var arInputs = document.getElementsByTagName("input");
-    
-    for (var elmInput in arInputs) {
-    
-      /* some code */
-    }
-
-}} 
+for (var elmInput in arInputs) {
+  /* some code */
+}
+~~~~~~

 Instead use this... 

-{{Good samp |1=
+~~~~~~
+var arInputs = document.getElementsByTagName("input");
+
+var elmInput;
+for (var i = arInputs.length - 1; i >= 0; --i) {
+  elmInput = arInputs[i];

-    
-    var arInputs = document.getElementsByTagName("input");
-    
-    var elmInput;
-    for (var i = arInputs.length - 1; i >= 0; --i) {
-      elmInput = arInputs[i];
-    
-      /* some code */
-    }
-    
-
-}} 
+  /* some code */
+}
+~~~~~~

 or 

-{{Good samp |1=
-    
-    
-    var arInputs = document.getElementsByTagName("input");
-    
-    for each(var elmInput in arInputs) {
-      /* some code */
-    }
-    
+~~~~~~
+var arInputs = document.getElementsByTagName("input");

-}} 
+for each(var elmInput in arInputs) {
+  /* some code */
+}
+~~~~~~

 ### Named Items

XPCNativeWrapper modified by Martz

Martz — Fri, 27 Jun 2014 23:40:50 -0000

Overview
- wrappedJSObject
  - Security
Limitations / Problems

Overview

Most all objects on a target web page that a user script sees are wrapped in XPCNativeWrapper. The reason for this is so that a script can change the properties of an object (actually the wrapper) without any JavaScript on the target page being able to see it. Mostly the wrapping is "transparent" - wrapped and unwrapped objects seem to behave the same because the wrapping object passes methods to the wrapped object, though there are some some exceptions.

wrappedJSObject

For a script to access the real underlying object there is the method

{{Fair samp |why=Potential danger if a constructor init is called |1=

var realObj = wrappedObj.wrappedJSObject;

}}

Be very careful when using the wrappedJSObject property. It is just as dangerous as [UnsafeWindow] is.

Security

Related to [Security].

Limitations / Problems

Expando Properties

[Expando_Properties] do not work on XPCNativeWrappers. This means that, for example, this will not work:

{{Bad samp |1=

var el = document.createElement("a");
el.onclick = "alert('Error'); return false;";

}}

Instead, use setAttribute and addEventListener methods. Note the use of the preventDefault method to emulate the "return false" behavior above.

addEventListener example:

{{Good samp |1=

function showTheError(event) {
    event.preventDefault();

    /* some code */
}
var el = document.createElement("a");
el.addEventListener("click", showTheError, false);

}}

setAttribute example:

{{Good samp |1=

var el = document.createElement("a");
el.setAttribute("onclick", "alert('Error'); return false;");

}} This applies to any element, not just new ones you create (those references from

createElement

and those from

getElementById

et al), and any event handler, not just onclick.

for ... in on HTMLCollections

DOM methods like

getElementsByTagName

return

HTMLCollection

s. {{Bad samp |1=

var arInputs = document.getElementsByTagName("input");

for (var elmInput in arInputs) {

  /* some code */
}

}}

Instead use this...

{{Good samp |1=

var arInputs = document.getElementsByTagName("input");

var elmInput;
for (var i = arInputs.length - 1; i &gt;= 0; --i) {
  elmInput = arInputs[i];

  /* some code */
}

}}

{{Good samp |1=

var arInputs = document.getElementsByTagName("input");

for each(var elmInput in arInputs) {
  /* some code */
}

}}

Named Items

Items like frames, form elements, and so on can be referenced by name in normal JavaScript.

XPCNativeWrappers cannot reference items by name. Use the

namedItem

method. With a

&lt;input name="foo"&gt;

in the form: {{Bad samp |1=

form.foo;

}}

Instead use this...

{{Good samp |1=

form.elements.namedItem("foo");

}}

The same goes for frames:

{{Bad samp |1=

window.framename;

}}

Instead use this...

{{Good samp |1=

window.frames["framename"];

}}}

X [Category:Scripting_context]

Event Handlers

Normal JavaScript can access an element's event handlers with code like:

{{Bad samp |1=

element.onclick = myClickHandler;

}}

{{Bad samp |1=

element.onclick = "myClickHandler(this)";

}} This does not work on XPCNativeWrappers; it will result in a

Component not available

error in the JavaScript console. Instead, use

addEventListener

: {{Good samp |1=

element.addEventListener("click", myClickHandler, false);

}}

Any Greasemonkey script written before version 0.5 was released in mid-2005 may need updating to use addEventListener.

https://developer.mozilla.org/En/DOM/Element.addEventListener