4

Does the Greasemonkey Firefox run JS in it's own sandbox/layer or does it need global javascript on the pages it is running on?

By that I mean if I had another plugin like NoScript block a page's JS, would using Greasemonkey result in the page's JS then being unblocked? Or, would the page's JavaScript remain blocked and Greasemonkey's JavaScript just run over the top of it in it's own layer with everything still being secure? I did give it a quick test and the pages JS seemed blocked, so probably fine. However I am not fully sure how it hooks into websites/browser JS.

Ooker
  • 1,969
  • 4
  • 28
  • 58
zeddex
  • 1,260
  • 5
  • 21
  • 38

2 Answers2

4

Yes, one of the good things about Greasemonkey is that it can run scripts on a page, even if javascript is disabled for that page. And, no, it does not unblock the page's JS.

Unless you use Script Injection, Greasemonkey scripts always operate in a separate scope -- which is not switched off by NoScript, etc.
Additionally, GM scripts will operate from a sandbox depending on the effective @grant settings. See "Why is window (and unsafeWindow) not the same from a userscript as from a tag?" for more information.

Community
  • 1
  • 1
Brock Adams
  • 90,639
  • 22
  • 233
  • 295
1

I think http://wiki.greasespot.net/Security should answer all your questions. Specifically,

[the Firefox 1.5 update] used to isolate privileged user script code from insecure content pages

Bergi
  • 630,263
  • 148
  • 957
  • 1,375