Greasemonkey throws "DOMException: The operation is insecure." on document.implementation.createHTMLDocument().open()

Question

FF 84.0.2, GM 4.10.0

The code can be seen at GitLab. The relevant part is:

        ...
        const doc = document.implementation.createHTMLDocument('http://www.w3.org/1999/xhtml', 'html');
console.debug("DOC CREATED")
        doc.open() // <-- with GM: DOMException: The operation is insecure.
console.debug("DOC OPENED")
        ...

Console output:

...
DOC CREATED
DOMException: The operation is insecure.

Script works with Tampermonkey.

Tampermonkey runs in page context whereas GM4 runs in a true sandbox. You'll need to use wrappedJSObject and exportFunction for this, see [more info](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Sharing_objects_with_page_scripts) (it's for extensions but applies here as well). See if you can switch to `new Document()` instead. — wOxxOm, Jan 16 '21 at 17:08
@wOxxOm Thanks for the info. If I use `new Document()` instead of `document.implementation.createHTMLDocument()` the result on `doc.open()` is _DOMException: An attempt was made to use an object that is not, or is no longer, usable_. — Gerold Broser, Jan 16 '21 at 21:05
@wOxxOm I read the doc for the two, property and function. It refers to content scripts vs. page scripts. Unfortunately I'm not that deep into JS to see how this can help me here. — Gerold Broser, Jan 16 '21 at 22:07
Sandbox of GM4 is like a content script whereas document.implementation refers to the page script context, I guess. BTW why do you use this super arcane method at all, why not insertAdjacentHTML? — wOxxOm, Jan 17 '21 at 06:12
If doctype is the same as the current document's you can probably use DOMParser and replace document.documentElement with the new one. — wOxxOm, Jan 17 '21 at 12:18
@wOxxOm The `page.responseText` I get is a full-featured HTML page starting with ` ...` so I have to insert this into a `HTMLDocument` as-is. I can't create a `new Document().createElement('html').insertAdjacentHTML('afterbegin', page.responseText);`. Or do you have another hint how to achieve this? Is there some kind of pseudo-element after `new Document()` on that I can use `insertAdjacentHTML()`? — Gerold Broser, Jan 17 '21 at 12:18
@wOxxOm I'm not changing the current document in any way. The `doc` I create (from an other page's HTML content) is just used in the script internally to be able to `doc.querySelectorAll()` elements from this other page. — Gerold Broser, Jan 17 '21 at 12:22
Are there DOMParser that work on plain (HTML) text rather than on an HTMLDocument object? — Gerold Broser, Jan 17 '21 at 12:31
DOMParser parses plain text string into a DOM document, see the documentation/examples. — wOxxOm, Jan 17 '21 at 12:34

Gerold Broser · Accepted Answer · 2021-01-17T18:43:26.820

Got a solution from an answer to DOM parsing in JavaScript:

        ...
        const doc = document.implementation.createHTMLDocument('http://www.w3.org/1999/xhtml', 'html');
        doc.documentElement.innerHTML = page.responseText
        ...

instead of:

        ...
        const doc = document.implementation.createHTMLDocument('http://www.w3.org/1999/xhtml', 'html');
        doc.open()
        doc.write( page.responseText )
        ...

Greasemonkey throws "DOMException: The operation is insecure." on document.implementation.createHTMLDocument().open()

1 Answers1