javascript: call an embedded function from a GM script

Question

On a webpage there's

<script>
  function fn982734()
  {
     // some code
  }
</script>

In my Greasemonkey script, I have the following code:

var fn = fields[5].getElementsByTagName("a")[0].getAttribute('onclick').substr(7,11);
console.log(fn); // outputs fn982734 to the firebug console
window[fn]();

This code does not work, and spawns an error in the error console: window[fn] is not a function. However, typing directly into firebug:

var fn = 'fn982734';
window[fn]();

works perfectly. What's going on?

Brock Adams · Accepted Answer · 2010-07-15 22:44:52Z

2

The Greasemonkey script is inside a sandbox and Firebug is not. See: "Avoid Common Pitfalls" (in Greasemonkey).

Your GM script would access that function via unsafeWindow. Like so:

unsafeWindow.fn982734();

.
Alternatively,

var fn = 'fn982734';
unsafeWindow[fn]();

Also works -- from inside the Greasemonkey script.

edited Jul 15, 2010 at 22:44

answered Jul 15, 2010 at 10:14

Brock Adams

94k23 gold badges242 silver badges312 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Mala Over a year ago

replacing 'window[func]();' with 'unsafeWindow[func]()' results in a File Not Found error: Firefox can't find the file at jar:file:///usr/lib/firefox-3.6.6/chrome/browser.jar!/content/browser/[uri]

Brock Adams Over a year ago

@Mala: var fn = 'fn982734'; unsafeWindow[fn](); totally works, I double-checked to make sure. That error message also does not match the code shown. Paste the EXACT Greasemonkey code, and link to the target page.

kwah Over a year ago

Please do not encourage the use of unsafeWindow - it is named unsafe for a reason.

Brock Adams Over a year ago

@kwah, unsafeWindow is provided for a reason. There are many cases when it is the correct or only approach. ... While it is true that an unscrupulous website could theoretically exploit the use of unsafeWindow to gain slightly elevated privileges... (1) The script author will be able to ID sites that might try such tricks and is forewarned. (2) The odds are very low. The cost/benefit ratio of a webmaster, attempting this exploit, means it will never be used except, maybe, in extreme cases. (3) There are zero documented cases of an exploit in the wild and the test case 404's out.

kwah · Accepted Answer · 2011-07-02 13:57:18Z

0

I realise that I'm a little late to this question but Please do not encourage the use of unsafeWindow - it is named unsafe for a reason.

The correct alternative would be to use the "location hack" as described on Greasemonkey's Greasepot Wiki. This code should correctly call the function described in the original post:

location.href = "javascript:void(fn982734())";

answered Jul 2, 2011 at 13:57

kwah

1,1491 gold badge13 silver badges28 bronze badges

Collectives™ on Stack Overflow

javascript: call an embedded function from a GM script

2 Answers 2

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related