{"id":3034,"date":"2011-09-01T16:18:13","date_gmt":"2011-09-01T23:18:13","guid":{"rendered":"http:\/\/blog.mozilla.org\/addons\/?p=3034"},"modified":"2011-10-05T12:29:41","modified_gmt":"2011-10-05T19:29:41","slug":"add-on-sdk-faq-content-script-access","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/addons\/2011\/09\/01\/add-on-sdk-faq-content-script-access\/","title":{"rendered":"Add-on SDK FAQ: Content Script Access"},"content":{"rendered":"

Update<\/strong>: the SDK 1.2 beta builds ( including this one, just released today ) now include a more refined version of this content. If you’re interested in this material I strongly suggest that you download this beta<\/a> and take a look at the bundled docs.
\n<\/em>
\nThis post is an attempt to clearly explain how content scripts work. I am posting this particular topic as a blog post in hopes of getting feedback on the wording, but the content below is actually part of a larger patch against the SDK documentation that Will Bamberg<\/a> created as part of this SDK bug<\/a>. The specific purpose of this post is to explain the access that content scripts have to:<\/p>\n

\n
DOM objects in the pages they are attached to<\/li>\n
other content scripts<\/li>\n
other scripts loaded by the page they are attached to<\/li>\n<\/ul>\n
<\/p>\n
Access to the DOM<\/h2>\n
Content scripts need to be able to access DOM objects in arbitrary web pages, but this gives rise to a potential security problem. A malicious page could redefine standard functions and properties of DOM objects so they don’t do what the add-on expects. To deal with this, content scripts access DOM objects via a proxy. Any changes they make are made to the proxy.<\/p>\n
The proxy is based on XRayWrapper<\/code>, (also known as XPCNativeWrapper<\/code><\/a>). These wrappers give the user access to the native values of DOM functions and properties, even if they have been redefined by a script.<\/p>\n
For example: the page below redefines window.confirm()<\/code> to return true<\/code> without showing a confirmation dialog:<\/p>\n
\r\n\r\n\r\n \r\n