This API object allows a User script to access "custom" properties--variable and functions defined in the page--set by the web page. The unsafeWindow
object is shorthand for window.wrappedJSObject
. It is the raw window object inside the XPCNativeWrapper provided by the Greasemonkey Sandbox.
unsafeWindow
bypasses the Greasemonkey XPCNativeWrapper-based Security model, which exists to make sure that malicious web pages cannot alter objects in such a way as to make greasemonkey scripts (which execute with more privileges than ordinary JavaScript running in a web page) do things that their authors or users did not intend. User scripts should therefore avoid calling or in any other way depending on any properties on unsafeWindow
- especially if they are executed for arbitrary web pages, such as those with @include, where the page authors may have subverted the environment in this way.
User script authors are strongly encouraged to learn how XPCNativeWrappers work, and how to perform the desired function within their security context, instead of using unsafeWindow
to break out.
⬆ ⬇ | Examples | Alternatives to unsafeWindow | Notes
unsafeWindow
Value: Object
Returns: Variant
Compatibility: Greasemonkey 0.5b+
Access: @grant
unsafeWindow.SomeVarInPage = "Testing";
or
unsafeWindow.SomeFunctionInPage("Test");
or
var oldFunction = unsafeWindow.SomeFunctionInPage; unsafeWindow.SomeFunctionInPage = function(text) { alert("Hijacked! Argument was " + text + "."); return oldFunction(text); };
⬆ ⬇ | Events | Functions defined in the page | Attach script to page
Event listeners never need to be created on unsafeWindow. Rather than using
unsafeWindow.onclick = function(event) { /* some code */ };
use:
window.addEventListener("click", function(event) { /* some code */ }, false);
See also addEventListener at MDN
If a user script must execute a page function, it can use the Location hack to call it safely. This involves setting location.href to a javascript:
URL, which is like using a bookmarklet. For example:
location.href = "javascript:void(pageFunc(123));";
Larger blocks of code independent of the Greasemonkey context/APIs can also be executed this way:
location.href = "javascript:(" + function() { /* Some code here. Note that the Greasemonkey API is not directly accessible within this function. */ } + ")();";
or a more specific example:
location.href = "javascript:(" + encodeURI(uneval(function() { /* some code */ })) + ")();";
This code will run in the page context without leaking the Sandbox. This code is completely separate from the rest of the script scope, sometimes limiting its usefulness. For example, data cannot be returned by the function.
Another drawback is that this technique is rather ugly. Still, it is preferred over unsafeWindow
.
⬆ ⬇ ⇧ | Method 1 | Method 2 | Method 3
function myScript() { for (var x in document) { /* some code with x */ } /* some code */ } /** * Attaches script into page body and executes it via an anonymous function call. * * NOTES: Script can therefore reference variables on the page, but likewise * cannot use Greasemonkey API methods * */ var script = document.createElement("script"); script.type = "application/javascript"; script.textContent = "(" + myScript + ")();"; document.body.appendChild(script);
window.addEventListener( "DOMTitleChanged", function() { var redirectURL = window.name; }, false ); var sGetter = document.createElement("script"); sGetter.type = "application/javascript"; sGetter.textContent = "function uXHR(url) {" + " var xhr = new XMLHttpRequest();" + " xhr.onreadystatechange = function() { " + " if (xhr.status == 301 || xhr.status == 302) {" + " window.name = xhr.getResponseHeader('Location');" + " document.title = document.title;" + " }" + " };" + " xhr.open('HEAD', url, true);" + " xhr.send(null);" + "}"; document.body.appendChild(sGetter); unsafeWindow.uXHR(url);
Place this code at the very beginning of the script to inject the entire script into the page using the location hack. Like Method 1, this will give the script access to variables on the page, but not access to Greasemonkey API methods.
if (typeof window.wrappedJSObject == "object") { location.href = "javascript:(" + encodeURI(arguments.callee.toSource()) + ")();"; return; }
Be very careful when using the wrappedJSObject
property. It can be just as dangerous as unsafeWindow
is.
BUG: In Firefox 3.0.x the prototype
field will always be undefined
for objects accessed through unsafeWindow
. Method 1 can be used as a workaround for this problem.
Wiki: Global_object
Wiki: Greasemonkey_Manual:API
Wiki: Greasemonkey_Manual:Environment
Wiki: Greasemonkey_Manual:Other_Useful_Tools
Wiki: Main_Page
Wiki: Sandbox
Wiki: Security
Wiki: User_script
Wiki: Version_history
Wiki: XPCNativeWrapper