@@ -355,9 +355,24 @@ function GM_isGreasemonkeyable(url) { .getService(Components.interfaces.nsIIOService) .extractScheme(url); - return (scheme == "http" || scheme == "https" || scheme == "file" || - scheme == "ftp" || url.match(/^about:cache/)) && - !/hiddenWindow\.html$/.test(url); + if ("http" == scheme) return true; + if ("https" == scheme) return true; + if ("ftp" == scheme) return true; + if ("data" == scheme) return true; + + if ("file" == scheme) { + return GM_prefRoot.getValue('fileIsGreaseable'); + } + + if ("about" == scheme) { + // Always allow "about:blank". + if (/^about:blank/.test(url)) return true; + + // Conditionally allow the rest of "about:". + return GM_prefRoot.getValue('aboutIsGreaseable'); + } + + return false; } function GM_isFileScheme(url) { content/utils.js @@ -1 +1,3 @@ pref("extensions.{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.description", "chrome://greasemonkey/locale/greasemonkey.properties"); +pref("greasemonkey.aboutIsGreaseable", false); +pref("greasemonkey.fileIsGreaseable", false); defaults/preferences/greasemonkey.js 8cc502c92629b090e4d016af9ff7e56c13557862 Anthony Lieuallen arantius@gmail.com http://github.com/teramako/greasemonkey-for-prism/commit/61695fe69493136dadd30b2206caf478d5096ecc 61695fe69493136dadd30b2206caf478d5096ecc 2009-08-12T20:18:49-07:00 2009-08-11T09:00:17-07:00 Alter GM_isGreasemonkeyable() for security and features. Restrict greasing file: and about: URLs, to plug a potential security hole. (Add an about:config accessible preference to override this.) Add greasing data: URLs, and always about:blank (regardless of above). Signed-off-by: Johan Sundström <oyasumi+github@gmail.com> 300eee2b86db6d9e166c860bde0604e8027f04ba Johan Sundström oyasumi+github@gmail.com