FF @sandbox Javascript unsafeWindow access is broken

[Owyn]

(Please fill out the issue template with your details)

Expected Behavior

undefined

Actual Behavior

variable

Specifications

• Firefox 106
• TM: 4.18
• OS: Win 10

Script

(Please give an example of the script if applicable.)

// ==UserScript==
// @name		test
// @namespace	test
// @version		1
// @description	test
// @author		Owyn
// @match		*://*/*
// @grant		unsafeWindow
// @sandbox		JavaScript
// @run-at		document-end
// ==/UserScript==

(function() {
	'use strict';

console.warn(unsafeWindow);
console.warn(unsafeWindow.adsbygoogle);
})();

result: - can't access any variables in unsafeWindow

[derjanb]

Should be fixed at 4.19.6172 (xpi)

Please install the BETA version or check for BETA version updates at about:addons

For a quick fix please export your settings and scripts as zip or (JSON) file at the "Utilities" tab and import it back at the fixed BETA version.

[Owyn]

With 4.18.1 unsafewindow variables work fine again but there's a problem with functions... you can set functions in unsafewindow and call them but only from the userscript - the page itself can't do that due to restrictions

// ==UserScript==
// @name		test
// @namespace	test
// @version		1
// @description	test
// @author		Owyn
// @match		*://*/*
// @grant		unsafeWindow
// @sandbox		JavaScript
// @run-at		document-start
// ==/UserScript==

(function() {
	'use strict';

unsafeWindow.myfunc = function (){return true;}
console.warn(unsafeWindow.myfunc);

})();

[Owyn]

and I think that also goes for listener functions, page can't access them so it also can't run them, example, my DOMContentLoaded just stopped working cuz I was adding it from unsafeWindow

// ==UserScript==
// @name		test
// @namespace	test
// @version		1
// @description	test
// @author		Owyn
// @match		*://*/*
// @grant		unsafeWindow
// @sandbox		JavaScript
// @run-at		document-start
// ==/UserScript==

(function() {
	'use strict';

unsafeWindow.addEventListener("DOMContentLoaded", function(){ console.error("DOMContentLoaded unsafe"); }); // doesn't work

window.addEventListener("DOMContentLoaded", function(){ console.error("DOMContentLoaded window"); }); // works

})();

[derjanb]

I guess this is where cloneInto needs to come in due to Firefox's security model. Will release a new BETA soon.

[Owyn]

If it will be a clone - that means cloned functions won't be able to access & monitor variables inside the userscript? (and especially gm.getvalue ones) (also call functions if no cloneFunctions option it seems as the wiki says)

edit: - but I guess that could be workarounded by putting variables inside unsafeWindow and calling functions from there as well,
Cloning is still better than nothing at this point, I'll be waiting for it

[derjanb]

If it will be a clone - that means cloned functions won't be able to access & monitor variables inside the userscript

No, the function keeps its scope and can access it

Should be fixed at 4.19.6176 (xpi)

Please install the BETA version or check for BETA version updates at about:addons