Access NPAPI from pages DOM

Question

I'm attempting to override the default functionality for webkitNotifications.createNotification and via a Chrome extension I'm able to inject a script in the pages DOM that does so. Problem I'm having now is I need access to chrome.extension.sendRequest from the pages DOM in order to push my request to the NPAPI I have embedded in the background page. I previously had the embed object rendered on each page during the execution of the content-script - but believe it's more effective (and safe) if the NPAPI is embedded within the extension not injected on every page.

if (window.webkitNotifications)
{
    (function()
    {
        window.webkitNotifications.originalCreateNotification = window.webkitNotifications.createNotification;
        window.webkitNotifications.createNotification = function (iconUrl, title, body) {
            var n = window.webkitNotifications.originalCreateNotification(iconUrl, title, body);
            n.original_show = n.show;
            n.show = function ()
            {
                console.log("Chrome object", chrome);
                console.log("Chrome.extension object", chrome.extension);
                chrome.extension.sendRequest({'title' : title, 'body' : body, 'icon' : iconUrl});
            }
            return n;
        }
    })();
}

That is what is injected in the DOM as a script element. The background page is as follows:

<embed type="application/x-npapiplugz" id="plugz">
<script>
var osd = document.getElementById('plugz');

function processReq(req, sender, callback)
{
    osd.notify(req.title, req.body, req.image);

    console.log("NOTIFY!", req.title, req.body, req.image);
};

chrome.extension.onRequest.addListener(processReq);
</script>

Answer 1

Once your extension includes a NPAPI plugin, it is no longer safe :) But your correct, instead of allowing every single page have access to the plugin, it is better to let your extension have it. I assume you know about the "public" property which specifies whether your plugin can be accessed by regular web pages, the default is false.

Below, I will explain whats your problem, it isn't a accessing NPAPI from DOM pages problem, it is basically why can't your notifications access your content script or extension pages.

As you noticed, access to the content scripts and the pages DOM are isolated from each other. The only thing they share, is the DOM. If you want your notifications override to communicate to your content script, you must do so within a shared DOM. This is explained in Communication with the embedding page in the Content Scripts documentation.

You could do it the event way, where your content script listens on such event for data coming from your DOM, something like the following:

var exportEvent = document.createEvent('Event');
exportEvent.initEvent('notificationCallback', true, true);
window.webkitNotifications.createNotification = function (iconUrl, title, body) {
  var n = window.webkitNotifications.createNotification(iconUrl, title, body);
  n.show = function() {
    var data = JSON.stringify({title: title, body: body, icon: iconUrl});
    document.getElementById('transfer-dom-area').innerText = data;
    window.dispatchEvent(exportEvent);
  };
  return n;
}
window.webkitNotifications.createHTMLNotification = function (url) {
  var n = window.webkitNotifications.createHTMLNotification(url);
  n.show = function() {
    var data = JSON.stringify({'url' : url});
    document.getElementById('transfer-dom-area').innerText = data;
    window.dispatchEvent(exportEvent);
  };
  return n;
};

Then your event listener can send that to the background page:

// Listen for that notification callback from your content script.
window.addEventListener('notificationCallback', function(e) {
  var transferObject = JSON.parse(transferDOM.innerText);
  chrome.extension.sendRequest({NotificationCallback: transferObject});
});

I added that to my gist on GitHub for the whole extension (https://gist.github.com/771033), Within your background page, you can call your NPAPI plugin.

I hope that helps you out, I smell a neat idea from this :)