[Greasemonkey] greasemonkey for secure data over insecure networks / sites

Godmar Back godmar at gmail.com
Tue Jul 19 01:32:32 EDT 2005

On 7/19/05, Aaron Boodman <zboogs at gmail.com> wrote:
> So, I propose the sandbox approach. GM_xmlhttpRequest will verify that
> URLs it accesses are http or https. I realize this may be brittle and
> failure-prone, we'll have to do our best -- maybe mozilla provides
> interfaces which can help normalize the URLs before we do the check.

You probably want to exclude http://localhost/ as well, but see below.
> Other than that, I don't believe we have a problem with any of the
> other APIs, and we'll think about future APIs much more carefully.
> The user script code itself will run in the content's security
> principal, which is very low priv, the same context the site itself
> runs in.
> In a previous thread you asked some questions. I'll attempt to answer
> them now, though I admit from the beginning that you know more about
> this than me!

Actually, I don't.  I'm as new to Firefox/Mozilla as you are, I only
know that all of these problems were investigated in the context of
Java, and my own research is tangentially related to it.
> > Suppose the code contains
> > addEventListener("someevent", function () { .... }, false)
> > or
> > setTimeout(10, function () { ... })
> >
> > In which security context will those functions execute?
> As you said, it depends on the root of the stack. In both these cases,
> user scripts don't have access to (namespace approach) any objects
> which could exceute in a context other than content. Specifically it's
> |window|setTimeout and |DOMNode|addEventListener. Both of those are in
> the content's security context.

Does this then mean that a GM script (using the sandbox approach)
could not access GM_xmlhttprequest *except* from within the code that
is initially executed via "evalInSandbox", but not in code/closure
that is executed later when a user interacts with a greased page?
(these questions can be answered by experimentation)

 - Godmar

More information about the Greasemonkey mailing list