Access methods and properties of arbitrary Objective-C object from JavaScript

Question

I want to access properties and call methods of an Objective-C object that was returned to JavaScript host as property of exposed object ([windowScriptObject setValue:self forKey:@"a"]):

- (id) valueForUndefinedKey:(NSString*) key {
  if ( [key isEqualToString:@"b"] ) {
    MyObject* obj = [ [ MyObject alloc ] init ];
    return obj;
  }
  return Nil;
}

In Javascript I want to be able to do the following:

// a is already exposed Objective-C object
var b = a.b; // reference to myObject
var c = a.b.c; // myObject.c
var d = a.b.d(); // [ myObject d ]

Rob Napier · Accepted Answer · 2009-09-03 14:42:47Z

1

MyObject needs to implement +isSelectorExcludedFromWebScript: and/or +isKeyExcludedFromWebScript:. By default, Javascript is not allowed to access Objective-C methods; you have to explicitly permit it.

Are you seeing some other symptom beyond that?

For more information, see Using Objective-C From Javascript.

answered Sep 3, 2009 at 14:42

Rob Napier

301k37 gold badges492 silver badges660 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Dmitry Mukhin Over a year ago

i've read all that. using -valueForUndefinedKey:, setValue:forUndefinedKey:, -invokeUndefinedMethodFromWebScript:withArguments: one can dispatch arbitrary gets, sets and method calls from JavaScript to Objective-C object, exposed as shown in Using Objective-C From Javascript. I want to go further and return (make accessible via a.b.c) another Objective-C object to JavaScript host.

Rob Napier Over a year ago

You will then still need to make sure that MyObject allows Javascript access (which is what +isSelectorExcludedFromWebScript: is for). Also, is this Javascript local to the machine, or coming from the network? Granting remote Javascript unlimited access to the Cocoa process makes the product very hard to secure, and would allow an attacker to run arbitrary code as the user with DNS spoofing (or a variety of other common attacks). This isn't a problem if the Javascript is stored in your own bundle (as in the case of Pandoraboy's Javascript bridge).

Dmitry Mukhin Over a year ago

-isSelectorExcludedFromWebScript: and -isKeyExcludedFromWebScript: return NO. JavaScript is local, I want to build more flexible bridge between JS and core app code.

Rob Napier Over a year ago

So what issue are you seeing?

Rob Napier Over a year ago

I'm not certain if this is a bug in the bridge or not. If you turn this into a method call (make it b() and move the code to invokeUndefinedMethodFromWebScript:withArguments: it works as expected. It also works if you just define a method called -b. It's having trouble only in the KVC routine (valueForUndefinedKey:). I suspect that this routine is not wrapping the result into a WebScriptObject. You may need to open a radar on that (bugreport.apple.com).

Collectives™ on Stack Overflow

Access methods and properties of arbitrary Objective-C object from JavaScript

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related