1516356 - export helpers not available in userscript sandbox

Status: RESOLVED WONTFIX

(WebExtensions :: General, defect)

Description

[sdaniele3]

Attachment: user-script-register-example-v2.xpi

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

This should likely be linked to bug 1437867 (which sandbox options should be allowed). But either way, since the userscript context is considered 'restricted' compared to the page context, it's somewhat difficult to interact with the page without the export helpers.


Reproduce:

1)
Install the attached extension. It's the same extension as found in bug 1509339

2)
Open the extension sidebar (should auto open).

3)
Fill in the details:


scriptMetadata.name: my-registered-userscript
Hosts: *://*.org/*
[ Leave the rest BLANK ]

Code:
```
var unsafeWindow = window.wrappedJSObject;

function readyMessage() {
  console.log("I'm ready!");
}

unsafeWindow.readyMessage = exportFunction(readyMessage, unsafeWindow);
```

4)
Click the "Register Script" button

5)
Open the browser console ( CTRL+SHIFT+J )

6)
Navigate to https://hg.mozilla.org

7)
Examine console for `ReferenceError: exportFunction is not defined`


Actual results:

Failure to export the function 'onReady' because the export helper is not available.


Expected results:

From step 7) there should be no error. And further:

8)
Open scratch pad ( SHIFT + F4 )

9)
run:
window.readyMessage();

10)
Examine console for `I'm ready!`

Comment 1

[Luca Greco [:rpl] [:luca] [:lgreco]]

Attachment: user-script-register-example-v2-with-exportFunction.xpi

(In reply to sdaniele3 from comment #0)
> This should likely be linked to bug 1437867 (which sandbox options should be
> allowed). But either way, since the userscript context is considered
> 'restricted' compared to the page context, it's somewhat difficult to
> interact with the page without the export helpers.
> 
> 
> Reproduce:
> ...
> 3)
> Fill in the details:
> ...
> Code:
> ```
> var unsafeWindow = window.wrappedJSObject;
> 
> function readyMessage() {
>   console.log("I'm ready!");
> }
> 
> unsafeWindow.readyMessage = exportFunction(readyMessage, unsafeWindow);
> ```
> ...

Hi sdaniele3,
The userScripts API already allows the extension itself to provide this kind of helpers (if they are needed and they should be available to the particular user script), because the userScripts's apiScript has these helpers available (as for regular content scripts) e.g. as an example of how it can be achieved, the attached extension is exactly like the one from attachment 9033244 [details], but it also defines `exportFunction` as follows:

```
browser.userScripts.onBeforeScript.addListener(script => {
  ...
  script.defineGlobals({
    ...
    exportFunction(fn, global) {
      return exportFunction(fn, global);
    }
  });
  ...
});
```