Security Review

[topdan]

Need to ensure websites aren't given chrome privileges and userscripts can't expose website data to other websites.

[topdan]

The userscript pattern I use from this MDN document: https://developer.mozilla.org/en/Components.utils.evalInSandbox

json = Components.utils.evalInSandbox("render(#{JSON.stringify(limitedRequest)});", sandbox)
if typeof json == 'string'
  # trust the json string

the MDN example uses an integer, which could be a key part to the security with string not working. I don't know

[topdan]

Also crossDomain is a userscript API function because flash players sometimes make requests for data across domains. This is a security hole if not made clear to uses when installing scripts.

• userscripts declare what domains they want access to, users agree to allow it