Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

API is unsafely added to the sandbox

#8

We protect scripts by wrapping them inside a function (currently, unless @unwrap is used).
We should protect the API similarly, otherwise it is accessible from the hostile environment after unsafeWindow usage.

See: GM#225

Reported by Olivier Cornu · March 15th, 2009 @ 12:49 PM

State: invalid
Milestone: none
Assigned to: Olivier Cornu Olivier Cornu

Activity

  1. Olivier Cornu
    Olivier Cornu
    • State changed from new to resolved

    (from [f6d11e1b4c9f6415bd8fdea053d3e0122b0bfab7]) Protect GM API from malicious content-window hijacking [#8 API is unsafely added to the sandbox state:resolved] http://github.com/ocornu/webmonk...

    March 24th, 2009 @ 11:36 AM

  2. Olivier Cornu
    Olivier Cornu
    • State changed from resolved to invalid
    • Milestone cleared.

    With the new injection logic it is not possible to wrap scripts in a function from WM any longer. Impossible to protect the API similarly either.

    September 2nd, 2009 @ 11:40 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.