javascript - Is calling a method of `unsafeWindow` in GM script with privileges a vulnerable practice? -

-

i have script like

// ==userscript== // @grant       gm_getvalue // @grant       gm_setvalue // @include     * // @run-at      document-start // ==/userscript==  var foo = gm_getvalue('foo'); var _open = unsafewindow.open; unsafewindow.open = function(){    if( /* */ ){       _open();    }    settimeout(function() {         gm_setvalue('bar', 'bar');     }, 0); }

maybe malicious site could

  • add getter window.open execute malicious code when var _open = unsafewindow.open
  • add setter window.open execute malicious code when unsafewindow.open = /*...*/
  • replace window.open malicious function, execute when use _open()

could way malicious site gain privileges use gm_getvalue or gm_setvalue, or variables defined in script (like foo)?


Comments

Post a Comment

Popular posts from this blog

ios - RestKit 0.20 — CoreData: error: Failed to call designated initializer on NSManagedObject class (again) -

-
this error has shown on many times, seems. prominent answer issue seems restkit 0.20 — coredata: error: failed call designated initializer on nsmanagedobject class however, solution posted doesn't work me. let's start beginning: i want upload file server. want parse response make sure uploaded. if not, try again later. model has boolean variable called nsnumber *senttoserver purpose (in coredata, bool saved nsnumber ) . because don't know whether sending going successful, save entity coredata model first before sending via restkit. when post request successful, server returns json string this: {"id":14,"created":true} notice that, of course, id not set on coredata model yet, both id , created new informations model. here's model: @interface recording : nsmanagedobject @property (nonatomic, retain) nsstring * audiofilepath; @property (nonatomic, retain) nsdate * createdat; @property (nonatomic, retain) nsstring * deviceid; @...
Read more

laravel - PDOException in Connector.php line 55: SQLSTATE[HY000] [1045] Access denied for user 'root'@'localhost' (using password: YES) -

-
my .env: app_env=local app_debug=true app_key=myappkey app_url=http://localhost db_connection=mysql db_host=localhost db_port=3306 db_database=gestiontaller db_username=root db_password='root' cache_driver=file session_driver=file queue_driver=sync redis_host=127.0.0.1 redis_password=null redis_port=6379 mail_driver=smtp mail_host=mailtrap.io mail_port=2525 mail_username=null mail_password=null mail_encryption=null i've tried password ", ' , without, restarting server every time. i've tried changing localhost 172.0.0.1. yes, password correct, running mysql -u root -p introducing password root in prompt can go mysql. users table: +------------------+-----------+ | user | host | +------------------+-----------+ | debian-sys-maint | localhost | | mysql.sys | localhost | | root | localhost | | root1 | localhost | +------------------+-----------+ i've added homestead.yaml this: database_port: 3306 ...
Read more

c# - How to display vlc video from small screen to another vlc big screen "vlcplugin21" -

-
i'm trying display video in big screen when click on button "view video" after loaded windows in small screen via vlc player "vlcplugin21" in windows form application the following code load video windows , display via vlc player: public void readvlc1() { ofd.filter = "all files (*.*) | *.*"; if (ofd.showdialog() == dialogresult.ok) { vlc1.playlist.items.clear(); vlc1.playlist.add("file:///" + ofd.filename,ofd.safefilename, null); txt_videoname.text = ofd.safefilename; } } i want click on button example "view video in full screen" , display same video big vlc screen. any help??
Read more