Skip to content

Commit

Permalink
dynamically inject variables into scope when added to 'window' sandbox
Browse files Browse the repository at this point in the history
  • Loading branch information
warren-bank committed Nov 28, 2024
1 parent 7e0cd65 commit baedf1e
Show file tree
Hide file tree
Showing 7 changed files with 109 additions and 22 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,4 @@
window = self = globalThis = unsafeWindow;

var userscript_wrapper = function(){
with (window) {
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@
_GM_getWindowProxyTarget(/* useWindowPrototype= */ true),
_GM_getWindowProxyHander(/* windowOwnProps= */ {}, /* propBlacklist= */ [/* 'localStorage', 'sessionStorage' */])
);
window.window = window.self = window;
window.window = window.self = window.globalThis = window;
if (unsafeWindow.top === unsafeWindow) {
window.top = window;
}
Expand All @@ -155,3 +155,4 @@
}

var userscript_wrapper = function(){
with (window) {
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
}
}

userscript_wrapper.call(window)
Expand Down
File renamed without changes.
50 changes: 50 additions & 0 deletions tests/0021a2-closure-sandbox.user.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
// ==UserScript==
// @name test: with closure, without sandbox
// @namespace WebViewWM
// @match *://*/*
// @grant none
// @run-at document-end
// ==/UserScript==

var clean_dom = function() {
while(document.body.childNodes.length) {
document.body.removeChild(document.body.childNodes[0]);
}
}

var append_to_dom = function(text) {
var div = document.createElement('div');
var pre = document.createElement('pre');
var hr = document.createElement('hr');

pre.innerText = text;
div.appendChild(pre);
document.body.appendChild(div);
document.body.appendChild(hr);
}

clean_dom()
append_to_dom(`with closure, without sandbox:\n@grant none`)

append_to_dom(`(typeof window) = ${(typeof window)}`)
append_to_dom(`(typeof this) = ${(typeof this)}`)
append_to_dom(`(typeof self) = ${(typeof self)}`)
append_to_dom(`(typeof globalThis) = ${(typeof globalThis)}`)
append_to_dom(`(typeof unsafeWindow) = ${(typeof unsafeWindow)}`)

append_to_dom(`(window === this) = ${(window === this)}`)
append_to_dom(`(window === self) = ${(window === self)}`)
if (typeof globalThis !== 'undefined')
append_to_dom(`(window === globalThis) = ${(window === globalThis)}`)

append_to_dom(`(window instanceof Window) = ${(window instanceof Window)}`)

if (typeof unsafeWindow !== 'undefined') {
append_to_dom(`(unsafeWindow instanceof Window) = ${(unsafeWindow instanceof Window)}`)
append_to_dom(`(window === unsafeWindow) = ${(window === unsafeWindow)}`)
}

append_to_dom(`(typeof GM_info) = ${(typeof GM_info)}`)
append_to_dom(`(typeof window.GM_info) = ${(typeof window.GM_info)}`)
if (typeof unsafeWindow !== 'undefined')
append_to_dom(`(typeof unsafeWindow.GM_info) = ${(typeof unsafeWindow.GM_info)}`)
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
// @name test: with closure, with sandbox
// @namespace WebViewWM
// @match *://*/*
// @grant unsafeWindow
// @run-at document-end
// ==/UserScript==

Expand Down
75 changes: 54 additions & 21 deletions tests/0021b-closure-sandbox.user.js
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
// ==UserScript==
// @name test: with closure, without sandbox
// @name test: with closure, with sandbox
// @namespace WebViewWM
// @match *://*/*
// @grant none
// @grant unsafeWindow
// @run-at document-end
// ==/UserScript==

"use strict";

var clean_dom = function() {
while(document.body.childNodes.length) {
document.body.removeChild(document.body.childNodes[0]);
Expand All @@ -23,28 +25,59 @@ var append_to_dom = function(text) {
document.body.appendChild(hr);
}

clean_dom()
append_to_dom(`with closure, without sandbox:\n@grant none`)
var append_table_to_dom = function() {
var table = document.createElement('table');

table.setAttribute('border', '1px');
table.setAttribute('style', 'white-space: nowrap;');

document.body.appendChild(table);
return table
}

var append_table_row = function(table, cols, is_heading) {
var tr = document.createElement('tr');
var td;

append_to_dom(`(typeof window) = ${(typeof window)}`)
append_to_dom(`(typeof this) = ${(typeof this)}`)
append_to_dom(`(typeof self) = ${(typeof self)}`)
append_to_dom(`(typeof globalThis) = ${(typeof globalThis)}`)
append_to_dom(`(typeof unsafeWindow) = ${(typeof unsafeWindow)}`)
for (col of cols) {
td = document.createElement(is_heading? 'th' : 'td');
td.textContent = col;
tr.appendChild(td);
}

append_to_dom(`(window === this) = ${(window === this)}`)
append_to_dom(`(window === self) = ${(window === self)}`)
if (typeof globalThis !== 'undefined')
append_to_dom(`(window === globalThis) = ${(window === globalThis)}`)
table.appendChild(tr);
}

append_to_dom(`(window instanceof Window) = ${(window instanceof Window)}`)
var append_table_heading = function(table) {
var cols = ['', 'foo', 'unsafeWindow.foo', 'window.foo', 'self.foo', 'this.foo', 'globalThis.foo'];
append_table_row(table, cols, true);
}

if (typeof unsafeWindow !== 'undefined') {
append_to_dom(`(unsafeWindow instanceof Window) = ${(unsafeWindow instanceof Window)}`)
append_to_dom(`(window === unsafeWindow) = ${(window === unsafeWindow)}`)
var append_table_row_for_variable = function(table, what, variable_name, typeof_variable) {
var cols = [what, typeof_variable, typeof unsafeWindow[variable_name], typeof window[variable_name], typeof self[variable_name], typeof this[variable_name], typeof globalThis[variable_name]];
append_table_row(table, cols, false);
}

append_to_dom(`(typeof GM_info) = ${(typeof GM_info)}`)
append_to_dom(`(typeof window.GM_info) = ${(typeof window.GM_info)}`)
if (typeof unsafeWindow !== 'undefined')
append_to_dom(`(typeof unsafeWindow.GM_info) = ${(typeof unsafeWindow.GM_info)}`)
clean_dom();
append_to_dom('with closure, with sandbox:');

var table = append_table_to_dom();
append_table_heading(table);

var variable_01 = 1;
append_table_row_for_variable.call(this, table, 'var foo = 1', 'variable_01', typeof variable_01);

unsafeWindow.variable_02 = 1;
append_table_row_for_variable.call(this, table, 'unsafeWindow.foo = 1', 'variable_02', typeof variable_02);

window.variable_03 = 1;
append_table_row_for_variable.call(this, table, 'window.foo = 1', 'variable_03', typeof variable_03);

self.variable_04 = 1;
append_table_row_for_variable.call(this, table, 'self.foo = 1', 'variable_04', typeof variable_04);

this.variable_05 = 1;
append_table_row_for_variable.call(this, table, 'this.foo = 1', 'variable_05', typeof variable_05);

globalThis.variable_06 = 1;
append_table_row_for_variable.call(this, table, 'globalThis.foo = 1', 'variable_06', typeof variable_06);

0 comments on commit baedf1e

Please sign in to comment.