Greasemonkey Hacks/Getting Started - Revision history

Andy.somerville: /* Security Hole #1: Source Code Leakage */ Fix indent formatting

Andy.somerville — Sun, 26 Jul 2009 15:52:56 GMT

Security Hole #1: Source Code Leakage - Fix indent formatting

←Older revision		Revision as of 15:52, 26 July 2009
Line 1,052:		Line 1,052:
	_scripts.push(arScripts[_c++].innerHTML);		_scripts.push(arScripts[_c++].innerHTML);
	}		}
-		+	}
-	}	+	document.addEventListener("DOMNodeInserted", trapInsertScript, true);
-	document.addEventListener("DOMNodeInserted", trapInsertScript, true);	+	</script>
-	</script>	+

	Whenever Greasemonkey 0.3 injected a user script into this page (by adding a <tt><Script></tt> element), Firefox called the <tt>trapInsertScript</tt> function, which allowed the remote page to store a copy of the entire source code of the user script that had just been injected. Even though Greasemonkey removed the <tt><Script></tt> element immediately, the damage had already been done. The remote page could get a complete copy of every user script that executed on the page, and do whatever it wanted with that information.		Whenever Greasemonkey 0.3 injected a user script into this page (by adding a <tt><Script></tt> element), Firefox called the <tt>trapInsertScript</tt> function, which allowed the remote page to store a copy of the entire source code of the user script that had just been injected. Even though Greasemonkey removed the <tt><Script></tt> element immediately, the damage had already been done. The remote page could get a complete copy of every user script that executed on the page, and do whatever it wanted with that information.

Maskull: /* Examples */ - looks like closing bracket was left off

Maskull — Sat, 18 Jul 2009 00:31:29 GMT

Examples - - looks like closing bracket was left off

←Older revision		Revision as of 00:31, 18 July 2009
Line 691:		Line 691:

	var snapProductImages = document.evaluate('''"//img[contains(@src,'''		var snapProductImages = document.evaluate('''"//img[contains(@src,'''
-	''' 'MZZZZZZZ')",'''	+	''' 'MZZZZZZZ')]",'''
	document, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);		document, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);

Maskull: /* Security Hole #3: Local File Access */

Maskull — Sat, 25 Oct 2008 01:19:13 GMT

Security Hole #3: Local File Access

←Older revision		Revision as of 01:19, 25 October 2008
Line 1,104:		Line 1,104:

	<script type="text/javascript">		<script type="text/javascript">
-	// _GM_xmlhttpRequest<nowiki>~~GM_xmlhttpRequest~~ was captured earlier,	+	// _GM_xmlhttpRequest<nowiki> was captured earlier,
	// via security hole #2		// via security hole #2

Maskull: /* Pitfall #6: scrollIntoView */ - fixed

Maskull — Wed, 10 Sep 2008 16:09:26 GMT

Pitfall #6: scrollIntoView - - fixed

←Older revision		Revision as of 16:09, 10 September 2008
Line 1,253:		Line 1,253:

	var elmFoo = document.getElementById('foo');		var elmFoo = document.getElementById('foo');
-	elmFoo.~~pitfallsXPCNativeWrappersscrollIntoViewscrollIntoView~~();	+	elmFoo.scrollIntoView();

	This does not work in Greasemonkey scripts, because <tt>elmFoo</tt> is an <tt>XPCNativeWrapper</tt>, and <tt>XPCNativeWrappers</tt> do not call the <tt>scrollIntoView</tt> method on the underlying wrapped element. Instead, you need to use the special <tt>wrappedJSObject</tt> property of the <tt>XPCNativeWrapper</tt> object to get a reference to the real element, and then call its <tt>scrollIntoView</tt> method:		This does not work in Greasemonkey scripts, because <tt>elmFoo</tt> is an <tt>XPCNativeWrapper</tt>, and <tt>XPCNativeWrappers</tt> do not call the <tt>scrollIntoView</tt> method on the underlying wrapped element. Instead, you need to use the special <tt>wrappedJSObject</tt> property of the <tt>XPCNativeWrapper</tt> object to get a reference to the real element, and then call its <tt>scrollIntoView</tt> method:

Maskull: /* Examples */ - pretty sure this is incorrect, too, so I'm fixing it

Maskull — Fri, 29 Aug 2008 17:07:51 GMT

Examples - - pretty sure this is incorrect, too, so I'm fixing it

←Older revision		Revision as of 17:07, 29 August 2008
Line 707:		Line 707:

	var elmFirstResult = document.evaluate('''"//a[@class='yschttl']",''' document,		var elmFirstResult = document.evaluate('''"//a[@class='yschttl']",''' document,
-	null, ~~<b>~~XPathResult.FIRST_ORDERED_NODE_TYPE~~</b>~~, null)'''.singleNodeValue;'''	+	null, '''XPathResult.FIRST_ORDERED_NODE_TYPE''', null)'''.singleNodeValue;'''

Maskull: /* Examples */

Maskull — Fri, 29 Aug 2008 01:19:28 GMT

Examples

←Older revision		Revision as of 01:19, 29 August 2008
Line 692:		Line 692:
	var snapProductImages = document.evaluate('''"//img[contains(@src,'''		var snapProductImages = document.evaluate('''"//img[contains(@src,'''
	''' 'MZZZZZZZ')",'''		''' 'MZZZZZZZ')",'''
-	document, null, ~~XPathXPathResult~~.UNORDERED_NODE_SNAPSHOT_TYPE, null);	+	document, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);

	You can also do combinations of attributes. This query finds all images with a width of 36 and a height of 14. (This query is taken from "Zap Ugly XML Buttons" [[Greasemonkey Hacks/Syndication#Zap Ugly XML Buttons\|'''[Hack #86]''']].)		You can also do combinations of attributes. This query finds all images with a width of 36 and a height of 14. (This query is taken from "Zap Ugly XML Buttons" [[Greasemonkey Hacks/Syndication#Zap Ugly XML Buttons\|'''[Hack #86]''']].)

Maskull: /* Examples */

Maskull — Fri, 29 Aug 2008 01:16:31 GMT

Examples

←Older revision		Revision as of 01:16, 29 August 2008
Line 673:		Line 673:
	The following XPath query finds all the elements on a page with <tt>class="foo"</tt>:		The following XPath query finds all the elements on a page with <tt>class="foo"</tt>:

-	var snapFoo = document.evaluate('''//*[@class='foo']",'''	+	var snapFoo = document.evaluate('''"//*[@class='foo']",'''
	document, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);		document, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);

Maskull: /* Inserting or Removing a Single Style */ - more code fixing

Maskull — Fri, 29 Aug 2008 00:58:20 GMT

Inserting or Removing a Single Style - - more code fixing

←Older revision		Revision as of 00:58, 29 August 2008
Line 592:		Line 592:
	The <tt>insertRule</tt> method takes two parameters. The first is the CSS rule to insert, and the second is the positional index of the rule before which to insert the new rule:		The <tt>insertRule</tt> method takes two parameters. The first is the CSS rule to insert, and the second is the positional index of the rule before which to insert the new rule:

-	document.~~web pagesstyle alterationstyleSheets~~[0].insertRule('html, body { font-size: large }', 0);	+	document.styleSheets[0].insertRule('html, body { font-size: large }', 0);

	<div class="tip">		<div class="tip">

Maskull: /* Adding an Element */ - fixed

Maskull — Wed, 27 Aug 2008 20:44:31 GMT

Adding an Element - - fixed

←Older revision		Revision as of 20:44, 27 August 2008
Line 474:		Line 474:
	The following code adds a new element to the end of the page. The element will appear at the bottom of the page, unless you style it with CSS to position it somewhere else [[Greasemonkey Hacks/Getting Started#Alter a Page's Style\|'''[Hack #7]''']]:		The following code adds a new element to the end of the page. The element will appear at the bottom of the page, unless you style it with CSS to position it somewhere else [[Greasemonkey Hacks/Getting Started#Alter a Page's Style\|'''[Hack #7]''']]:

-	var ~~web pagescontentelmNewContent~~ = document.createElement('div');	+	var elmNewContent = document.createElement('div');
	document.body.appendChild(elmNewContent)		document.body.appendChild(elmNewContent)

Maskull: /* Namespace */

Maskull — Wed, 27 Aug 2008 20:41:06 GMT

Namespace

←Older revision		Revision as of 20:41, 27 August 2008
Line 194:		Line 194:
	Next comes the ''namespace'':		Next comes the ''namespace'':

-	// ~~directivesuser scripts@namespace~~<nowiki>@namespace http://www.oreilly.com/catalog/~~greasemonkeyhcks~~/</nowiki>	+	// <nowiki>@namespace http://www.oreilly.com/catalog/greasemonkeyhacks/</nowiki>

	This is a URL, which Greasemonkey uses to distinguish user scripts that have the same name but are written by different authors. If you have a domain name, you can use it (or a subdirectory) as your namespace. Otherwise, you can use a <tt>tag</tt>: URI.		This is a URL, which Greasemonkey uses to distinguish user scripts that have the same name but are written by different authors. If you have a domain name, you can use it (or a subdirectory) as your namespace. Otherwise, you can use a <tt>tag</tt>: URI.