0

Is there any way to override localStorage and sessionStorage object's methods from content script? I am trying to disallow inline script to clear storages by executing this code from my Chrome extension (content script that runs before page is loaded). The code is:

// ==UserScript==
// @name         StorageSaver
// @match        http://barbars.org/*
// @grant        none
// @run_at       startup
// ==/UserScript==
/* jshint -W097 */
'use strict';

// Your code here...
location.href = "javascript: localStorage.clear = function(){alert('local works!');}";
location.href = "javascript: sessionStorage.clear = function(){alert('session works!');}";
John Smith
  • 29
  • 4
  • you can clear localStorage without calling any methods using delete+for-in... – dandavis Jan 12 '16 at 19:19
  • your code works in the console on this page, so the clear() method CAN be overwritten, sounds like it's just not getting done. – dandavis Jan 12 '16 at 19:29
  • I am sure that the storages are being cleared every time page refreshes from inline script that is located in `` section. And this script is using `.clear()` method to clear both storages. – John Smith Jan 12 '16 at 19:40
  • do you need localStorage to function? you might be able to freeze() it – dandavis Jan 12 '16 at 19:41
  • What I need is to prevent my key-value pairs from clearing after page is refreshed. My script is using them to know what to do on next page refresh and inline script is erasing them. – John Smith Jan 12 '16 at 19:45
  • you could use another storage mechanism. cookies, window.name, indexedDB, sharedWorker, etc – dandavis Jan 12 '16 at 19:57
  • Can you advice me such simple storage as local or session? Cookies are more complicated. – John Smith Jan 12 '16 at 20:02

1 Answers1

0

Ah, I believe you are trying to execute

window.localStorage.clear = function() {};

in your content script. Your content script has a different window than the page's, so that won't work. A workaround would be as simple as this:

location.href = "javascript: localStorage.clear = function(){}";

or injecting a <script> tag.

This will be executed in the page instead of the scope of your content script.

Derek 朕會功夫
  • 92,235
  • 44
  • 185
  • 247
  • But will it work if inline script is executing these methods using `window`? Like that: window.localStorage.clear(); window.sessionStorage.clear(); – John Smith Jan 12 '16 at 19:19
  • The `window.` is redundant, since you are executing the code in `window` already (the global scope). – Derek 朕會功夫 Jan 12 '16 at 19:20
  • Just tried to replace two lines in content script as you said. No result. The storages continue to be cleared after each refresh. – John Smith Jan 12 '16 at 19:23
  • When are you executing the content script? Are you running it at `document_start`? – Derek 朕會功夫 Jan 12 '16 at 19:24
  • Some more info. I have added alert to overwritten method. It works, but storage is still empty after refresh. Maybe it executes both methods (base and overwritten)? I am running it at `document_start` btw. – John Smith Jan 12 '16 at 19:25
  • Maybe the page isn't really executing `.clear` but actually removing each entry one by one instead? – Derek 朕會功夫 Jan 12 '16 at 19:27
  • I am sure it is. Some more info. I get alert from overwritten method only when I manually refresh page (press button in browser) but when I am navigating from page to page using links I recieve no alerts. I am sure that every page has the same script in `` section. – John Smith Jan 12 '16 at 19:32
  • Since I don't have the page that you are talking about, I don't think I can solve the problem you are facing effectively. – Derek 朕會功夫 Jan 12 '16 at 19:33
  • @JohnSmith I made a quick test with Tampermonkey which executes the code on that site with `document_start` and it did work. The local storage entries are preserved. – Derek 朕會功夫 Jan 12 '16 at 19:42
  • I have updated question and added TM script. What's wrong with it? – John Smith Jan 12 '16 at 19:52
  • You have to set the `run_at` in the settings panel. http://i.stack.imgur.com/N03PV.png – Derek 朕會功夫 Jan 12 '16 at 19:55
  • Yes, sorry. It's `run_at stratup` in my script. But it continues to alert me only on manually refresh, but no results after link clicks. – John Smith Jan 12 '16 at 20:00
  • I figured out that my problem is very similar to this one: [link](http://stackoverflow.com/questions/10456392/greasemonkey-script-only-runs-when-page-is-reloaded) I have noticed `wicket:interface` in urls so I think the problem is with AJAX. But I am not familiar with it so I am expecting some suggestions. – John Smith Jan 12 '16 at 20:43