JSAPI User Guide
to files, the network, or anything browser-related. the most sensitive information they expose to scripts is the current date and time. object-capabilities-based security one way to keep a snake from eating a mouse is to keep the mouse and the snake in separate cages. one way to keep user a from accessing user b's sensitive data or dangerous functions is to keep each user's code in a separate sandbox. that is, create a separate jscontext and global object for each user, and always run each script in the appropriate context. when setting up a new global object, simply don't define any functions the user shouldn't have access to. this approach is called object-capabilities security. to learn more about it, watch the movie or read the book. the metaphor is misleading in one regard: the snake ca...
...s called object-capabilities security. to learn more about it, watch the movie or read the book. the metaphor is misleading in one regard: the snake can't reach the mouse because there's a physical barrier in the way. with spidermonkey the situation is more subtle. there's no barrier; there's just no way to get there from here. how can a malicious script get a reference to an object from another sandbox? it might as well be in a parallel universe. even global variables are per-sandbox. there is no getobjectfromothersandbox() function. your application just needs to take care not to expose any such function to scripts. in short, never pass one user's data and objects to another user's code, and you'll have no access control issues. spidermonkey won't do it if you don't. trade-offs. object-capab...
...s data and objects to another user's code, and you'll have no access control issues. spidermonkey won't do it if you don't. trade-offs. object-capabilities security is security without run-time security checks. it is easy to implement, easy to reason about, and fast. but in fairness there are some drawbacks. first, the failure mode is pretty severe. if you do accidentally leak an object from one sandbox into another, the genie is out of the bottle. once a malicious script gets a reference to a single object in a sandbox, it can use that object to get a reference to the sandbox's global object, and from there, almost any other object or function in that sandbox. there is no way to fix it except to destroy both sandboxes and start over. a second drawback is that the system doesn't automatically re...
...And 2 more matches

Introduction to the File and Directory Entries API - Web APIs
the file and directory entries api interacts with other related apis. it was built on the file writer api, which, in turn, was built on file api. each of the apis adds different functionality. these apis are a giant evolutionary leap for web apps, which can now cache and process large amounts of data. ...
...gement. in chrome, you can use the file and directory entries api with the quota management api, which lets you ask for more storage and manage your storage quota. sample use cases the following are just a few examples of how you can use the file and directory entries api: apps with persistent uploader when a file or directory is selected for upload, you can copy the file into a local sandbox and upload a chunk at a time. the app can restart uploads after an interruption, such as the browser being closed or crashing, connectivity getting interrupted, or the computer getting shut down. video game or other apps with lots of media assets the app downloads one or several large tarballs and expands them locally into a directory structure. the app pre-fetches assets in the back...
...instead, it is a virtualized file system that looks like a full-fledged file system to the web app. it does not necessarily have a relationship to the local file system outside the browser. what this means is that a web app and a desktop app cannot share the same file at the same time. the api does not let your web app reach outside the browser to files that...
...And 2 more matches

Index - Web APIs
sents an absolute or relative number of milliseconds, depending on the specification in which it appears. 767 domtokenlist api, dom, domtokenlist, interface, reference the domtokenlist interface represents a set of space-separated tokens. such a set is returned by element.classlist, htmllinkelement.rellist, htmlanchorelement.rellist, htmlareaelement.rellist, htmliframeelement.sandbox, or htmloutputelement.htmlfor. it is indexed beginning with 0 as with javascript array objects. domtokenlist is always case-sensitive. 768 domtokenlist.add() api, add, dom, domtokenlist, method, reference the add() method of the domtokenlist interface adds the given token to the list. 769 domtokenlist.contains() api, contains, dom, domtokenlist, method, referen...
... <input> element or by drag and drop. 1329 file and directory entries api api, file system api, file and directory entries api, files, non-standard, overview, reference the file and directory entries api simulates a local file system that web apps can navigate within and access files in. you can develop apps which read, write, and create files and/or directories in a virtual, sandboxed file system. 1330 file and directory entries api support in firefox api, chrome, compatibility, file system api, file and directory entries api, files, firefox, guide, offline, web compatibility, google, google chrome the original file system api was created to let browsers implement support for accessing a sandboxed virtual file system on the user's storage device. work to...
...em api in firefox? for more insights. 1331 introduction to the file and directory entries api api, beginner, file, file system api, file and directory entries api, guide, introduction, non-standard the file and directory entries api simulates a local file system that web apps can navigate around. you can develop apps that can read, write, and create files and directories in a sandboxed, virtual file system. 1332 fileentrysync api, file, file system api, interface, non-standard, reference the fileentrysync interface of the file system api represents a file in a file system. it lets you write content to a file. 1333 fileerror api, file api, files, obsolete, reference represents an error that occurs while using the filereader interface. ...
...And 2 more matches

<iframe>: The Inline Frame element - HTML: Hypertext Markup Language
ing a same-origin request, only send the origin when the protocol security level stays the same (https→https), and send no header to a less secure destination (https→http). unsafe-url: the referrer will include the origin and the path (but not the fragment, password, or username). this value is unsafe, because it leaks origins and paths from tls-protected resources to insecure origins. sandbox applies extra restrictions to the content in the frame. the value of the attribute can either be empty to apply all restrictions, or space-separated tokens to lift particular restrictions: allow-downloads-without-user-activation : allows for downloads to occur without a gesture from the user. allow-downloads : allows for downloads to occur with a gesture from the user. allow-forms: all...
...bmission is blocked. allow-modals: lets the resource open modal windows. allow-orientation-lock: lets the resource lock the screen orientation. allow-pointer-lock: lets the resource use the pointer lock api. allow-popups: allows popups (such as window.open(), target="_blank", or showmodaldialog()). if this keyword is not used, the popup will silently fail to open. allow-popups-to-escape-sandbox: lets the sandboxed document open new windows without those windows inheriting the sandboxing. for example, this can safely sandbox an advertisement without forcing the same restrictions upon the page the ad links to. allow-same-origin: if this token is not used, the resource is treated as being from a special origin that always fails the same-origin policy. allow-scripts: lets the resource r...
...-storage-access-by-user-activation : lets the resource request access to the parent's storage capabilities with the storage access api. allow-top-navigation: lets the resource navigate the top-level browsing context (the one named _top). allow-top-navigation-by-user-activation: lets the resource navigate the top-level browsing context, but only if initiated by a user gesture. ...
...And 2 more matches

LocalFileSystem - Web APIs
the argument of a successful callback is the filesystem object, which has two properties: the name and root of the file system. you can call the method more than once if you want to create two file systems: one that's temporary and one that's persistent. ...
...the argument of a successful callback is the filesystem object, which has two properties: the name and root of the file system. you can call the method more than once if you want to create two file systems: one that's temporary and one that's persistent. ...
...ed to call requestquota() again. subsequent calls are a noop. another api, the quota management api, lets you query an origin's current quota usage and allocation using window.webkitpersistentstorage.queryusageandquota(). to learn more, see this stackoverflow answer. (an older version of the api is described at managing html5 offline storage.) working within a single origin the file system is sandboxed to a single origin. this means that your app cannot read, or write the files of another app's files. your app cannot access files in an arbitrary folder (such as, my pictures, my documents) on the user's hard drive either. for more information about restrictions, see the basic concepts article. example the following is a code snippet that shows how you can request a file system storage. //t...
......

Window.print() - Web APIs
a pull request. ...
... full support 12firefox full support 1ie full support 5opera full support 6notes full support 6notes notes starting with opera 33, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.safari full support 1.1webview android full support 1notes full support 1notes notes starting with webview 46, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.chrome android ...
...t 1notes notes starting with webview 46, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.chrome android full support 18notes full support 18notes notes starting with chrome 46, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.firefox android no support nonotes no support nonotes notes see bug 1247609.opera android full support 10.1notes full support 10.1notes notes starting with opera 33, this method is...
...irefox android no support nonotes no support nonotes notes see bug 1247609.opera android full support 10.1notes full support 10.1notes notes starting with opera 33, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.safari ios full support 1samsung internet android full support 1.0notes full support 1.0notes notes starting with samsung internet 5.0, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow...

Window.prompt() - Web APIs
pull request. ...
... does not display a prompt to the user, and always returns undefined. it is not clear whether this is a bug or intended behavior. ...
...33, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.safari full support 1webview android full support 1notes full support 1notes notes starting with webview 46, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.chrome android full support 18notes full support 18notes notes starting with chrome 46, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.firefox android full support 4opera andr...
...thod is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.firefox android full support 4opera android full support 10.1notes full support 10.1notes notes starting with opera 33, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow-modals.safari ios full support 1samsung internet android full support 1.0notes full support 1.0notes notes starting with samsung internet 5.0, this method is blocked inside an <iframe> unless its sandbox attribute has the value allow...

Content Processes - Archive of obsolete content
in addition to the port property, workers also support the web worker api, which allows scripts to send messages to each other using the postmessage function. this function uses the same pipe internally, and causes a 'message' event to be emitted on the other side. as explained earlier, firefox doesn't yet use separate processes for tabs or add-ons, so instead, each content script is loaded in a sandbox. sandboxes were explained this article. accessing the dom the global for the content sandbox has the window object as its prototype. this allows the content script to access any property on the window object, even though that object lives outside the sandbox. recall that the window object inside the sandbox is actually a wrapper to the real object. a potential problem with the content scri...
... is defined on the underlying object, rather than the wrapper itself. this feature should only be used when you really need it, however. a few notes on security as we stated earlier, the sdk was designed with multiprocess support in mind, despite the fact that work on implementing this in firefox has currently been suspended. since both add-on modules and content scripts are currently loaded in sandboxes rather than separate processes, and sandboxes can communicate with each other directly (using imports/exports), you might be wondering why we have to go through all the trouble of passing messages between add-on and content scripts. the reason for this extra complexity is that the code for add-on modules and content scripts have different privileges. every add-on module can get chrome privilege...
... might be wondering why we have to go through all the trouble of passing messages between add-on and content scripts. the reason for this extra complexity is that the code for add-on modules and content scripts have different privileges. every add-on module can get chrome privileges simply by asking for them, whereas content scripts have the same privileges as the page it is running on. when two sandboxes have the same privileges, a wrapper in one sandbox provides transparent access to an object in the other sandbox. when the two sandboxes have different privileges, things become more complicated, however. code with content privileges should not be able to acces code with chrome privileges, so we use specialized wrappers, called security wrappers, to limit access to the object in the other sandb...

Downloading JSON and JavaScript in extensions - Archive of obsolete content
ensions is using xmlhttprequest (or some other mechanism) to download javascript or json (they are different) from a remote website. once the content has been downloaded, the extension authors proceed to use eval() to decode the string content into javascript objects. this practice is dangerous and will not, in fact, pass an amo review. so the extension will not be allowed to move out of the amo sandbox. the practice is dangerous because the decoded javascript has full chrome privileges and could perform some nasty actions. how could the javascript an extension downloads perform nasty actions? fairly easy if the webserver where the javascript is hosted were to be hijacked or compromised. it happens to the best of us. amo takes the threat very seriously. the good news is there are several ways ...
... extremely popular. use the json decoders, not eval()! downloading javascript of course there are times when javascript code modules are downloaded and injected into the extension. this usually happens because the extension is trying to keep some of its code fresh and dynamic, and the developers don't want to create a new version of the extension for each script change. ...
...ipt code modules are downloaded and injected into the extension. this usually happens because the extension is trying to keep some of its code fresh and dynamic, and the developers don't want to create a new version of the extension for each script change. in this case, javascript sandboxing should be used to isolate the downloaded javascript from the rest of the extension, and host application. sandboxing is done using components.utils.evalinsandbox(). the javascript code is added to the sandbox along with any "safe" objects the javascript needs to interact. sandboxing is not without its dangers and developers should read the sandboxing page carefully to make sure untrusted code is not leaked out of the sandbox. ...

How Mozilla's build system works
ionaries describing the build configuration is enough. if you insist on knowing more, this section is for you. all the code for reading moz.build files lives under /python/mozbuild/mozbuild/frontend/. mozbuild is the name of our python package that contains most of the code for defining how the build system works. moz.build files and mozbuild are different, so be careful not to confuse the two. sandbox.py contains code for a generic python sandbox. this code is used to restrict the environment moz.build files are executed under. reader.py contains the code that defines the moz.build sandbox (the mozbuildsandbox class) and the code for traversing a tree of moz.build files (the buildreader class) by following dirs and tiers variables. a buildreader is instantiated with a configuration, is told t...
...s used to restrict the environment moz.build files are executed under. reader.py contains the code that defines the moz.build sandbox (the mozbuildsandbox class) and the code for traversing a tree of moz.build files (the buildreader class) by following dirs and tiers variables. a buildreader is instantiated with a configuration, is told to read the source tree, and then emits a stream of mozbuildsandbox instances corresponding to the executed moz.build files. the mozbuildsandbox stream produced by the buildreader is typically fed into the treemetadataemitter class from emitter.py. the role of treemetadataemitter is to convert the low-level mozbuildsandbox dictionaries into higher-level function-specific data structures. these data structures are the classes defined in data.py. each class define...
...enerated a clang compilation database, for example, this would be an acceptable use of a buildbackend. technically, we don't need to feed the treemetadataemitter output into a buildbackend: it's possible to create your own consumer. however, a buildbackend provides a common framework from which to author consumers. along the same vein, you don't need to use treemetadataemitter to consume mozbuildsandbox instances. nor do you need to use buildreader to traverse the moz.build files. this is just the default framework we've established for our build system. legacy content the content below is considered legacy. it is preserved for historical reasons until this entire page is rewritten. makefile basics makefiles can be quite complicated, but mozilla provides a number of built-in rules that shoul...

Limitations of chrome scripts
eners in the content process, relaying the result back to the chrome process. the event object itself is relayed to the chrome process as a cpow. to make the shim unnecessary: register event listeners on the global object inside a frame script. for example: addeventlistener("load", handler, true) // for example if you need to contact the chrome process when that happens, send it a message. ...
...ss, relaying the result back to the chrome process. the event object itself is relayed to the chrome process as a cpow. to make the shim unnecessary: register event listeners on the global object inside a frame script. for example: addeventlistener("load", handler, true) // for example if you need to contact the chrome process when that happens, send it a message. ...
...ss. the event object itself is relayed to the chrome process as a cpow. to make the shim unnecessary: register event listeners on the global object inside a frame script. for example: addeventlistener("load", handler, true) // for example if you need to contact the chrome process when that happens, send it a message. sandboxes you can create sandboxes in the chrome or the content process. sandboxes are often used as a safe way to manipulate web content, and if that's your goal, create the sandbox in the content process. there is a shim for sandboxes: if you make a sandbox in the chrome process and give it content principals (by passing a cpow as the first argument to components.utils.sandbox) then we'll actually make it in the content process. nsiaboutmodule by default, custom a...

Components.utils.createObjectIn
for example, to create a new object in the compartment identified by contentwindow: var newobject = new contentwindow.object(); but it is really needeed from firefox 30 onwards when trying to manipulate the dom window. ...
...for example, to create a new object in the compartment identified by contentwindow: var newobject = new contentwindow.object(); but it is really needeed from firefox 30 onwards when trying to manipulate the dom window. ...
...for example, to create a new object in the compartment identified by contentwindow: var newobject = new contentwindow.object(); but it is really needeed from firefox 30 onwards when trying to manipulate the dom window. ...

Components.utils
returns an array created in specified compartment. createobjectin() creates a new object, created in the scope of the specified object's compartment. dispatch() dispatches a runnable to the current/main thread. if the parameter is passed, the runnable will be dispatch in the compartment of the parameter, which affects which error reporter gets called. evalinsandbox() runs javascript code in a sandbox, usually used to run code with restricted privileges. evalinwindow() removed in gecko 34. evaluate javascript code in a less-privileged javascript context. exportfunction() export a javascript function from a more-privileged to a less-privileged scope, allowing it to be called in the less-privileged scope. ...
...e. nondeterministicgetweakmapkeys() return the keys in a weak map. this operation is non-deterministic because it is affected by the scheduling of the garbage collector and the cycle collector. this should only be used to write tests of the interaction of the gc and cc with weak maps. obsolete since gecko 45 the function was moved to threadsafechromeutils nukesandbox() recomputewrappers() to be called from js only. this is for gecko internal use only, and may disappear at any moment. reporterror() reports a javascript error object to the error console. setwantxrays() to be called from js only. this is for gecko internal use only, and may disappear at any moment. scheduleprecisegc() schedules a garbage colle...
...e level of garbage collection level for full garbage collection. see js_setgczeal for details; this method calls through to that with the specified value as the zeal value. unwaivexrays() undoes waivexrays(): reapplies the xray filtering protection. waivexrays() removes the filtering provided by an xray. properties property type description sandbox nsixpccomponents_utils_sandbox creates sandbox objects for use with evalinsandbox(). ion boolean read only. strict boolean strict mode is enabled. this reflects the value of the javascript environment's option by the same name. read only. strict_mode boolean read only. werror boolean warnings should be treated as errors. this r...

Using IndexedDB in chrome
ser's browser from content javascript. (see using indexeddb for an overview.) however, the apis can also be accessed from system-privileged javascript using the components.utils.importglobalproperties() function: components.utils.importglobalproperties(["indexeddb"]); // from here on, it's like using indexeddb from content var req = indexeddb.open("my-database"); // ... ...
...pis can also be accessed from system-privileged javascript using the components.utils.importglobalproperties() function: components.utils.importglobalproperties(["indexeddb"]); // from here on, it's like using indexeddb from content var req = indexeddb.open("my-database"); // ... ...
...ddb"]); // from here on, it's like using indexeddb from content var req = indexeddb.open("my-database"); // ... if you are creating a sandbox, and want indexeddb to be available in it, use the wantglobalproperties option in the sandbox constructor: var options = { "wantglobalproperties": ["indexeddb"] } var principal = cc["@mozilla.org/systemprincipal;1"].createinstance(ci.nsiprincipal); var sandbox = components.utils.sandbox(principal, options); // the sandbox will have access to indexeddb var sandboxscript = 'var req = indexeddb.open("my-database");'; components.utils.evalinsandbox(sandboxscript, sandbox); before firefox 33, you would access indexeddb from chrome code using the initwindowless method of the nsiindexeddatabasemanager service. this method was removed in firefox 33. ...

Storage Access API - Web APIs
for resources loaded from all embedded origins and possibly across all websites. the storage access api is intended to solve this problem; embedded cross-origin content can request unrestricted access to its first-party storage on a site-by-site basis via the document.requeststorageaccess() method, and check whether it already has access via the document.hasstorageaccess() method. ...
...igin content can request unrestricted access to its first-party storage on a site-by-site basis via the document.requeststorageaccess() method, and check whether it already has access via the document.hasstorageaccess() method. in addition, sandboxed <iframe>s cannot be granted storage access by default for security reasons. the api therefore also adds the allow-storage-access-by-user-activation sandbox token. the embedding website needs to add this to allow storage access requests to be successful, along with allow-scripts and allow-same-origin to allow it to call the api, and execute in an origin that can have cookies: <iframe sandbox="allow-storage-access-by-user-activation allow-scripts allow-same-origin"> ... </iframe> the api is designed to limit the p...
...age was granted, and rejects if access was denied. note: user interaction propagates to the promise returned by both of these methods, allowing the callers to take actions that require user interaction without requiring a second click from the user. for example, a caller could open a pop-up window from the resolved promise without triggering firefox’s pop-up blocker. extensions to <iframe> sandbox the <iframe> element's sandbox attribute has a new token, allow-storage-access-by-user-activation, which permits sandboxed <iframe>s to use the storage access api to request storage access. specifications the api is currently only at the proposal stage — the standardization process has yet to begin. you can currently find specification details of the api at apple's introducing storage access...

Content-Security-Policy - HTTP
es of application manifest files. media-src specifies valid sources for loading media using the <audio> , <video> and <track> elements. object-src specifies valid sources for the <object>, <embed>, and <applet> elements. elements controlled by object-src are perhaps coincidentally considered legacy html elements and are not receiving new standardized features (such as the security attributes sandbox or allow for <iframe>). therefore it is recommended to restrict this fetch-directive (e.g., explicitly set object-src 'none' if possible). prefetch-src specifies valid sources to be prefetched or prerendered. script-src specifies valid sources for javascript. script-src-elem specifies valid sources for javascript <script> elements. script-src-attr specifies valid sources for javascript...
...for worker, sharedworker, or serviceworker scripts. document directives document directives govern the properties of a document or worker environment to which a policy applies. base-uri restricts the urls which can be used in a document's <base> element. plugin-types restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded. sandbox enables a sandbox for the requested resource similar to the <iframe> sandbox attribute. navigation directives navigation directives govern to which locations a user can navigate or submit a form, for example. form-action restricts the urls which can be used as the target of a form submissions from a given context. frame-ancestors specifies valid parents that may embed a page using <fram...
... ...

core/namespace - Archive of obsolete content
ment } = dom(this); element.parentnode.removechild(element); // ... }; // ... exports.view = view; // ... also, multiple namespaces can be used with one object: // ./widget.js let { cu } = require('chrome'); let { ns } = require('sdk/core/namespace'); let { view } = require('./view'); // note this is completely independent from view's internal namespace object. let sandboxes = ns(); function widget(options) { let { element, contentscript } = options; let widget = object.create(widget.prototype); view.call(widget, options.element); sandboxes(widget).sandbox = cu.sandbox(element.ownerdocument.defaultview); // ... } widget.prototype = object.create(view.prototype); widget.prototype.postmessage = function postmessage(message) { let { sa...
... function widget(options) { let { element, contentscript } = options; let widget = object.create(widget.prototype); view.call(widget, options.element); sandboxes(widget).sandbox = cu.sandbox(element.ownerdocument.defaultview); // ... } widget.prototype = object.create(view.prototype); widget.prototype.postmessage = function postmessage(message) { let { sandbox } = sandboxes(this); sandbox.postmessage(json.stringify(json.parse(message))); ... }; widget.prototype.destroy = function destroy() { view.prototype.destroy.call(this); // ... delete sandboxes(this).sandbox; }; exports.widget = widget; in addition access to the namespace can be shared with other code by just handing them a namespace accessor function. let { dom } = require('./...

Appendix C: Avoiding using eval in Add-ons - Archive of obsolete content
d within a very different security context, namely a website, where the origin of the data is usually known in all instances and where vulnerabilities would have a much smaller impact. what about jsonp? jsonp, which really is just another script tag containing generated, remotely retrieved code, is generally not secure. it might be possible to execute any retrieved jsonp code in an unprivileged sandbox (which is complicated!), but if you have a choice, just avoid jsonp altogether! passing around functions/code as strings often you'll want to pass functions or code to other functions, most notoriously settimeout and addeventlistener. often this is done passing around strings. // do not use! settimeout("dosomething();", 100); addeventlistener("load", "myaddon.init(); myaddon.onload();", true);...
...f you compute the names using external data. alternative: using bracket-access to object properties object properties can always accessed using the bracket syntax: obj["property"] === obj.property hence the following will work just fine without having to resort to eval. myaddon.phrases["word" + word] = "phrase"; if there is no way around eval()... please consider creating an unprivileged sandbox and execute your code by calling evalinsandbox. did i mention that you should use native json methods to parse json data? special thanks special thanks goes to wladimir palant of adblock plus, who wrote an article years back which heavily inspired this one. ...

Index - Archive of obsolete content
io/file provides access to the local filesystem. 89 io/text-streams provides streams for reading and writing text. 90 lang/functional functional helper methods. 91 lang/type functions for working with type detection. 92 loader/cuddlefish add-on sdk, cfx the sdk's module loader. 93 loader/sandbox create javascript sandboxes and execute scripts in them. 94 net/url no summary! 95 net/xhr provides access to xmlhttprequest functionality. 96 places/bookmarks create, modify, and retrieve bookmarks. 97 places/favicon helper functions for working with favicons. 98 places/history ...
...ensions is using xmlhttprequest (or some other mechanism) to download javascript or json (they are different) from a remote website. once the content has been downloaded, the extension authors proceed to use eval() to decode the string content into javascript objects. this practice is dangerous and will not, in fact, pass an amo review. so the extension will not be allowed to move out of the amo sandbox. 233 enhanced extension installation add-ons, extensions no summary! 234 extension etiquette add-ons, extensions, guide no summary! 235 extension library no summary! 236 extension packaging add-ons, extensions, guide, toolkit api no summary! 237 extension samples no summary! 238 e...

Tamarin build documentation - Archive of obsolete content
running $avm hello.abc (where hello.abc is a simple abc to print a string, or can substitute with any test abc) now any acceptance or performance tests can be run as on desktop using test/acceptance/runtests.py or tests/performance/runtests.py tamarin buildbot adobe maintains a continuous build and test system for tamarin redux, similar to tinderbox. tamarin buildbot tryserver the tryserver/sandbox is setup to allow users to push any code changes that they would like to have tested in the automated build/test process prior to actually pushing the changes. the sandbox is setup so that it is able to build and test branches that are based on either tamarin-central or tamarin-tracing. any comments, questions or problems can be directed to actionscript qe how to setup a user repository wit...
...he change number and not the hash. branch: which branch of tamarin the repository is based on, tamarin-central or tamarin-tracing. description: self explanatory check the status of the build @ http://tamarin-builds.mozilla.org/tamarin-redux/ , you can also see your build request in the queue at http://tamarin-builds.mozilla.org/build_trigger/requestbuild.cfm. if you no longer want you sandbox to build and it has not started yet, you can delete the build request from the queue from the request page. tryserver etiquette the sandbox is not a good substitute for running the regression tests locally to catch obvious problems. this is a shared resource, each request takes approximately 2+ hours to run so please use wisely. ...

Tamarin Tracing Build Documentation - Archive of obsolete content
//developer.mozilla.org/en/docs...formance_tests tamarin buildbot adobe maintains a continuous build and test system for tamarin tracing and continuous build and test system for tamarin central, similar to tinderbox. performance tests are also run on every build. see the latest build performance report for the latest results or a weekly performance report. tamarin buildbot tryserver the tryserver/sandbox is setup to allow users to push any code changes that they would like to have tested in the automated build/test process prior to actually pushing the changes. the sandbox is setup so that it is able to build and test branches that are based on either tamarin-central or tamarin-tracing. any comments, questions or problems can be directed to brent baker how to setup a user repository with the so...
...g.mozilla.org/ are accepted. revision: specify the revision number that will be built. currently this only accepts the change number and not the hash. branch: which branch of tamarin the repository is based on, tamarin-central or tamarin-tracing. builders: which platforms will be compiled and tested. description: self explanatory check the status of the build @ http://tamarin-builds.mozilla.org/sandbox/ tryserver etiquette the sandbox is not a good substitute for running the regression tests locally to catch obvious problems. this is a shared resource, each request takes approximately 3+ hours to run so please use wisely. ...

Makefiles - Best practices and suggestions
hardcoded values - avoid them like the plague. use variable assignments, autogen paths and dynamic file gathering. platform specific - avoid this logic whenever possible. ...
... targets = foo bar tans timestampdir = .ts all: $(timestampdir) $(targets) %: %.c $(cc) -o $@ $< $(timestampdir): $(mkdir) $@ # "clean" target garbage += $(targets) garbage_dirs += $(timestampdir) wrapper check/unit tests with a enable_tests conditional so tests can be disabled on demand. ifdef enable_tests ifeq ($(null),$(filter winnt os2,$(o...

Script security
cope. compartments compartments are the foundation for gecko's script security architecture. a compartment is a specific, separate area of memory. in gecko, there's a separate compartment for every global object. this means that each global object and the objects associated with it live in their own region of memory. normal content windows are globals, of course, but so are chrome windows, sandboxes, workers, the contentframemessagemanager in a frame script, and so on. gecko guarantees that javascript code running in a given compartment is only allowed to access objects in the same compartment. when code from compartment a tries to access an object in compartment b, gecko gives it a cross-compartment wrapper. this is a proxy in compartment a for the real object, which lives in compartment...
...wrapper. this denies access to all the object's properties, except for a few properties of window and location objects, as defined by the same-origin policy. privileged to unprivileged code the most obvious example of this kind of security relation is between system-privileged chrome code and untrusted web content, but there are other examples in gecko. the add-on sdk runs content scripts in sandboxes, which are initialized with an expanded principal, giving them elevated privileges with respect to the web content they operate on, but reduced privileges with respect to chrome. if the caller has a higher privilege than the target object, the caller gets an xray wrapper for the object. xrays are designed to prevent untrusted code from confusing trusted code by redefining objects in unexpec...

Investigating leaks using DMD heap scan mode
ory for your firefox dmd build, $srcdir for the top level of the firefox source directory, and $heapgraph for the location of the heapgraph repo, and $logdir for the location you want logs to go to. $logdir should end in a path separator. for instance, ~/logs/leak/. the command you need to run firefox will look something like this: xpcom_mem_bloat_log=1 moz_cc_log_shutdown=1 moz_disable_content_sandbox=t moz_cc_log_directory=$logdir moz_cc_log_process=content moz_cc_log_thread=main moz_dmd_shutdown_log=$logdir moz_dmd_log_process=tab ./mach run --dmd --mode=scan breaking this down: xpcom_mem_bloat_log=1: this reports a list of the counts of every object created and destroyed and tracked by the xpcom leak tracking system. from this chart, you can see how many objects of a particular type wer...
... alive, you can use this to easily see if we leaked an nsfoo object. moz_cc_log_shutdown=1: this generates a cycle collector log during shutdown. creating this log during shutdown is nice because there are less things unrelated to the leak in the log, and various cycle collector optimizations are disabled. a garbage collector log will also be created, which you may not need. moz_disable_content_sandbox=t: this disables the content process sandbox, which is needed because the dmd and cc log files are created directly by the child processes. moz_cc_log_directory=$logdir: this selects the location for cycle collector logs to be saved. moz_cc_log_process=content moz_cc_log_thread=main: these options specify that we only want cc logs for the main thread of content processes, to make shutdown less ...

Index
erty of type nsistackframe (idl definition) that represents a snapshot of the current javascript callstack. this can be used for various diagnostic purposes. 30 components.utils xpcom:language bindings, xpconnect components.utils is a collection of various useful xpconnect features. its interface is defined at js/xpconnect/idl/xpccomponents.idl. 31 components.utils.sandbox needsmarkupwork, reference, référence(2), xpcom:language bindings, xpconnect components.utils.sandbox is used to create a sandbox object for use with evalinsandbox(). 32 components.utils.cloneinto this function provides a safe way to take an object defined in a privileged scope and create a structured clone of it in a less-privileged scope. it returns a reference...
...lone of it in a less-privileged scope. it returns a reference to the clone: 33 components.utils.createobjectin add-ons, developing mozilla, extensions, javascript, reference, référence(2), xpcom:language bindings, xpconnect components.utils.createobjectin creates a new javascript object in the scope of the specified object's compartment. 34 components.utils.evalinsandbox add-ons, developing mozilla, extensions, javascript, xpcom:language bindings, xpconnect the evalinsandbox() function enables you to evaluate javascript code inside a sandbox you've previously created using the components.utils.sandbox constructor. 35 components.utils.evalinwindow this function enables code running in a more-privileged javascript context to evaluate...

Components object
call stack current javascript call stack utils provides access to several useful features utils.atline provides access to the value of the atline property in the javascript environment. utils.createobjectin creates a new object in the scope of the specified object's compartment. may only be called from javascript code. utils.evalinsandbox runs javascript code in a sandbox, usually used to run code with restricted privileges. utils.forcegc forces a garbage collection cycle. utils.getglobalforobject returns the global object with which a given object is associated (through its prototype chain at birth, for example). utils.getweakreference gets a weak reference for the object...
...back function to receive notification once collection is complete. utils.setgczeal() sets the gc zeal level for the context. utils.strict provides access to the value of the strict property in the javascript environment. utils.werror provides access to the value of the werror property in the javascript environment. utils.sandbox creates sandbox objects for use with evalinsandbox. utils.xml provides access to the value of the xml property in the javascript environment. ...

Language bindings
/idl/xpccomponents.idl.components.utils.cloneintothis function provides a safe way to take an object defined in a privileged scope and create a structured clone of it in a less-privileged scope. it returns a reference to the clone:components.utils.createobjectincomponents.utils.createobjectin creates a new javascript object in the scope of the specified object's compartment.components.utils.evalinsandboxthe evalinsandbox() function enables you to evaluate javascript code inside a sandbox you've previously created using the components.utils.sandbox constructor.components.utils.evalinwindowthis function enables code running in a more-privileged javascript context to evaluate a string in a less-privileged javascript context. the result is structured cloned back to the original context, unless it is ...
...hat the specified object's methods are all in the object's scope, and aren't cross-component wrappers.components.utils.reporterrorcomponents.utils.reporterror reports a javascript error object to the error console, and returns. it is meant for use by extension developers who have exception handler blocks which want to "eat" an exception, but still want to report it to the console.components.utils.sandboxcomponents.utils.sandbox is used to create a sandbox object for use with evalinsandbox().components.utils.scheduleprecisegcthis method lets scripts schedule a garbage collection cycle. the garbage collection cycle will occur sometime in the future, when no javascript code is executing. this is useful particularly when testing for memory leaks, because normal garbage collection is conservative when...

DOMTokenList.supports() - Web APIs
st interface returns true if a given token is in the associated attribute's supported tokens. this method is intended to support feature detection. syntax let trueorfalse = element.supports(token) parameters token a domstring containing the token to query for. returns a boolean indicating whether the token was found. ...
...eature detection. syntax let trueorfalse = element.supports(token) parameters token a domstring containing the token to query for. returns a boolean indicating whether the token was found. example let iframe = document.getelementbyid('display'); if (iframe.sandbox.supports('an-upcoming-feature')) { // support code for mystery future feature } else { // fallback code } if (iframe.sandbox.supports('allow-scripts')) { // instruct frame to run javascript // // (note: this feature is well-supported; this is just an example!) // } specifications specification status comment credential management level 1 working draft initial definition. ...

File and Directory Entries API - Web APIs
because this is a non-standard api, whose specification is not currently on a standards track, it's important to keep in mind that not all browsers implement it, and those that do may implement only small portions of it. check the browser compatibility section for details. ...
...s an error which is generated by synchronous file system calls. there are also two global functions (which are not part of the specification at this time and are implemented only by google chrome). they're available on the worker object and implemented in localfilesystemsync: requestfilesystemsync() and resolvelocalfilesystemsyncurl(). other interfaces localfilesystem gives you access to a sandboxed file system. localfilesystemsync lockedfile provides tools to deal with a given file with all the necessary locks. metadata specifications specification status comment file and directory entries api draft draft of proposed api this api has no official w3c or whatwg specification. ...

HTMLIFrameElement - Web APIs
by which to refer to the frame. htmliframeelement.featurepolicy read only returns the featurepolicy interface which provides a simple api for introspecting the feature policies applied to a specific document. htmliframeelement.referrerpolicy is a domstring that reflects the referrerpolicy html attribute indicating which referrer to use when fetching the linked resource. htmliframeelement.sandbox is a domsettabletokenlist that reflects the sandbox html attribute, indicating extra restrictions on the behavior of the nested content. htmliframeelement.scrolling is a domstring that indicates whether the browser should provide scrollbars for the frame. htmliframeelement.src is a domstring that reflects the src html attribute, containing the address of the content to be embedded. note th...
...definition of 'htmliframeelement' in that specification. living standard the following property has been added: allowfullscreen. html5the definition of 'htmliframeelement' in that specification. recommendation the following properties are now obsolete: scrolling, marginwidth, marginheight, longdesc, frameborder, and align. the following properties have been added: srcdoc, sandbox, and contentwindow. document object model (dom) level 2 html specificationthe definition of 'htmliframeelement' in that specification. obsolete the contentdocument property has been added. document object model (dom) level 1 specificationthe definition of 'htmliframeelement' in that specification. obsolete initial definition. ...

LocalFileSystemSync - Web APIs
the localfilesystemsync interface of the file system api gives you access to a sandboxed file system. it is intended to be used with webworkers. the methods are implemented by worker objects. about this document this document was last updated on march 2, 2012 and follows the w3c specifications (working draft) drafted on april 19, 2011. this specification is more or less abandonned, failing to get significant traction. basic concepts you can request access to a sandboxed file system by requesting localfilesystemsync object from within a web worker. the global methods in the window object requestfilesystemsync() and resolvelocalfilesystemsyncurl() methods are exposed to the worker's global scope. calling window.requestfilesystemsync() for creates new storage for your web app. for ...
...s fileexception; constants constant value description temporary 0 transient storage that can be be removed by the browser at its discretion. persistent 1 storage that stays in the browser unless the user or the app expunges it. methods requestfilesystemsync() requests a file system where data should be stored. you access a sandboxed file system by requesting a localfilesystemsync object from within a web worker using this global method, window.requestfilesystemsync(). [ research ] filesystemsync requestfilesystemsync( in unsigned short type, in unsigned long long size ); parameters type the storage type of the file system. the values can be either temporary or persistent. size the storage space—in bytes—tha...

Using the Storage Access API - Web APIs
age. this is particularly true for document.cookie access, as browsers will often return an empty cookie jar when third-party cookies are blocked. accessing a user's cookies in an embedded cross-origin iframe in this example we show how an embedded cross-origin <iframe> can access a user’s cookies under a storage access policy that blocks third-party cookies. ...
...n empty cookie jar when third-party cookies are blocked. accessing a user's cookies in an embedded cross-origin iframe in this example we show how an embedded cross-origin <iframe> can access a user’s cookies under a storage access policy that blocks third-party cookies. first of all, if the <iframe> is sandboxed, the embedding website needs to add the allow-storage-access-by-user-activation sandbox token to allow storage access requests to be successful, along with allow-scripts and allow-same-origin to allow it to call the api, and execute in an origin that can have cookies: <iframe sandbox="allow-storage-access-by-user-activation allow-scripts allow-same-origin"> ... </iframe> now on to the code executed inside the embedded document. since it does not...

Guides - Archive of obsolete content
this page lists more theoretical in-depth articles about the sdk. contributor's guide getting started learn how to contribute to the sdk: getting the code, opening/taking a bug, filing a patch, getting reviews, and getting help. modules learn about the module system used by the sdk (which is based on the commonjs specification), how sandboxes and compartments can be used to improve security, and about the built-in sdk module loader, known as cuddlefish. classes and inheritance learn how classes and inheritance can be implemented in javascript, using constructors and prototypes, and about the helper functions provided by the sdk to simplify this. private properties learn how private properties can be implemented in javascript using prefixes, closures, and weakmaps, and how the ...

content/worker - Archive of obsolete content
worker interface defined by the w3c. but unlike "web workers," these workers run in the same process as web content and browser chrome, so code within workers can block the ui. globals constructors worker(options) creates a content worker. parameters options : object required options: name type window object the content window to create javascript sandbox for communication with. optional options: name type contentscriptfile string,array the local file urls of content scripts to load. content scripts specified by this option are loaded before those specified by the contentscript option. optional. contentscript string,array the texts of content scripts to load. content scri...

lang/type - Archive of obsolete content
lean : boolean indicating if value is an array/flat object containing only atomic values and other flat objects. instanceof(value, type) returns true if value is an instance of a given type. this is similar to the instanceof operator. the difference is that the type constructor can be from a scope that has a different top level object: for example, it could be from a different iframe, module or sandbox. let { instanceof } = require('sdk/lang/type'); instanceof(new class(), class); // true function class() {} parameters value : object the variable to check. type : object the constructor to compare to value returns boolean : boolean indicating if value is an instance of type. source(value, indent, limit) returns the textual representation of value, containing property descriptors and t...

net/xhr - Archive of obsolete content
ry least, it can't access the user's filesystem. this can probably be done most securely by white-listing the protocols that can be used in the url passed to the open() method, and limiting them to http:, https:, and possibly a special scheme that can be used to access the add-on's packaged, read-only resources. finally, we need to also consider attenuating http/https requests such that they're "sandboxed" and don't communicate potentially sensitive cookie information. globals constructors xmlhttprequest() creates an xmlhttprequest. this is a constructor, so its use should always be preceded by the new operator. for more information about xmlhttprequest objects, see the mdn page on using xmlhttprequest and the security concerns section in this page. functions forceallowthirdpartycookie(xhr...

remote/parent - Archive of obsolete content
in"); processes.port.on("message-from-remote", function(process, message) { console.log("remote says: " + message); }); child process privileges a module loaded into a child process can't do everything that the same module loaded into the parent process can. multiprocess firefox restricts the things that code running in child processes is allowed to do. for example, when the child process is sandboxed, modules won't be able to access the file system. we don't yet have a full list of all the modules that a module in the child process can't load, but the sorts of things listed in limitations of frame scripts broadly apply. examples property retrieval this first example shows fetching a simple property from every existing and future process. remote.js runs in all child processes. // remote...

Low-Level APIs - Archive of obsolete content
access to the local filesystem with the nodejs path module api. io/byte-streams provides streams for reading and writing bytes. io/file provides access to the local filesystem. io/text-streams provides streams for reading and writing text. lang/functional functional helper methods. lang/type functions for working with type detection. loader/cuddlefish the sdk's module loader. loader/sandbox create javascript sandboxes and execute scripts in them. net/url enables you to read content from a uri. net/xhr provides access to xmlhttprequest functionality. places/bookmarks create, modify, and retrieve bookmarks. places/favicon helper functions for working with favicons. places/history access the user's browsing history. platform/xpcom implement xpcom objects, factories, and se...

Developing for Firefox Mobile - Archive of obsolete content
ore/promise supported event/core supported event/target supported frame/hidden-frame supported frame/utils supported io/byte-streams supported io/file supported io/text-streams supported lang/functional supported lang/type supported loader/cuddlefish supported loader/sandbox supported net/url supported net/xhr supported places/bookmarks not supported places/favicon not supported places/history not supported platform/xpcom supported preferences/service supported stylesheet/style supported stylesheet/utils supported system/environment supported ...

Bootstrapped extensions - Archive of obsolete content
ootstrappable extension, then add the traditional overlays as well. newer versions of firefox will use the bootstrap.js script, ignoring the components and overlays, while older versions will use the overlays. bootstrap entry points the bootstrap.js script should contain several specific functions, which are called by the browser to manage the extension. the script gets executed in a privileged sandbox, which is cached until the extension is shut down. startup called when the extension needs to start itself up. this happens at application launch time, when the extension is enabled after being disabled or after it has been shut down in order to install an update. as such, this can be called many times during the lifetime of the application. this is when your add-on should inject its ui, start...

Extension Etiquette - Archive of obsolete content
conflicts can occur, there are many others. in general, care must be taken whenever defining a name anywhere that other code might do likewise. strategies to avoid such conflicts include: avoid shared namespaces where possible many naming conflicts are best avoided by simply not sharing namespaces. scripts can be loaded into their own globals, such as commonjs modules, javascript modules, or sandboxes, to avoid most global variable and prototype conflicts. expando properties are best avoided using tools such as weakmaps. prefix names in shared namespaces when shared namespaces can't be avoided, the simplest solution to prevent conflicts is to use a distinct prefix for all of your names. class names for html elements created by the cool beans extension, for instance, might all be prefixed...

Jetpack Processes - Archive of obsolete content
me, areceiver) similar to nsijetpack.unregisterreceiver(), this function unregisters a callback previously registered with registerreceiver(). unregisterreceivers(amessagename) similar to nsijetpack.unregisterreceivers(), this function unregisters all callbacks for the given message name. createhandle() similar to nsijetpack.createhandle(), this function creates a new handle and returns it. createsandbox() this creates a new javascript sandbox and returns its global scope. this global scope does not contain privileged apis, or any non-standard javascript objects for that matter, though new globals can be endowed by simply attaching them to the global scope as properties. evalinsandbox(asandbox, ascript) evaluates the given script contents in the given sandbox's global scope. at minimum, javascrip...

Useful Mozilla Community Sites - Archive of obsolete content
round the world. adding your extension to amo is easy. all you need is your xpi, a few screenshots (good ones will make your extension much more appealing), and a few minutes to fill a couple of forms. but this won't make your extension public right away. amo has a review process that prevents malicious, insecure or low quality extensions to make it to the public site. your extension begins in a sandbox with limited access, and once you nominate it an editor will review it and see if it is appropriate for the public amo site, where everyone can see it and install it. the review process often takes a few weeks. just be patient and make sure your extension follows amo's policies when you nominate it. you can still get a good number of downloads while being in the sandbox. one of the main advantag...

Index of archived content - Archive of obsolete content
core/namespace core/promise dev/panel event/core event/target frame/hidden-frame frame/utils fs/path io/byte-streams io/file io/text-streams lang/functional lang/type loader/cuddlefish loader/sandbox net/url net/xhr places/bookmarks places/favicon places/history platform/xpcom preferences/event-target preferences/service remote/child remote/parent stylesheet/style stylesheet/utils system/child_process ...

Java in Firefox Extensions - Archive of obsolete content
good reason for calling java from within an xpcom component rather than from xul is to maintain a singleton (some singular java object) across all firefox windows. if you call java from xul, then each firefox window will have its own class loader and hence its own "singleton". the following approach is taken from the extension xquseme (note you must use the latest version, currently still in the sandbox, as prior versions only worked with liveconnect before java 6 update 11) which borrows some of the code of the java firefox extension in order to grant full privileges to java within a firefox extension, but it is easier to understand and doesn't require creation of a xpcom component. [note: a simpler hello world version than that below is now available at http://brett-zamir.me/java_demo/ ] for p...

Extenders - Archive of obsolete content
his page documents the jetpack prototype, which is no longer under active development. ...

Tamarin Acceptance Testing - Archive of obsolete content
in order to ensure that changes to the tamarin code base are high quality before submitting, all developers are required to complete the following steps. ...

The Implementation of the Application Object Model - Archive of obsolete content
xul! let's just extend html! still i say forget xul! let's just extend html and use it to represent the ui! that would also be an unwise decision for a variety of reasons. html is designed to handle documents and not to handle applications. it makes sense to maintain a clean separation between the web application and the web documents that the application contains. by keeping the dom tree in a sandbox (safely insulated from the containing aom tree in which it might occur), you have an easy means of distinguishing the two trees and preventing scripts in the dom tree from manipulating the aom tree. in other words, it makes sense to have two parallel languages, one for describing applications, and the other for describing documents that can be used by those applications. it does not make sense to...

2006-11-24 - Archive of obsolete content
they would like to discuss the use of it in bug 361026 rich results for searches a proposal for a search tool that gives users a quicker path to specific information they are looking for. ...

2006-10-27 - Archive of obsolete content
summary: mozilla.dev.tech.xpcom - oct 21-27, 2006 announcements none during this week. discussions evalinsandbox and xmlhttprequest a discussion about writing something that calls a function defined by the page that the user is currently on chrome files and last modified date ways to retrieve the last modified date of a chrome file that may be in a jar or on the file system. meetings none during this week. ...

Common causes of memory leaks in extensions - Extensions
see also kris maglione's guide to cleaning up bootstrapped extensions. failing to clean up event listeners extensions can be disabled and removed by user actions, but it also happens when an add-on is updated. if a bootstrapped (restartless) extension fails to clean up event listeners when disabled or removed, the listeners will still reference the enclosing scope — usually the bootstrap.js sandbox — and therefore keep that scope (and its enclosing compartment) alive until the window is unloaded. if the window in question is browser.xul or some long-lived web app such as gmail, the leaked compartment might survive for quite some time. function leakref() {} function main(window) { // this is a potential leak, as the window (e.g. browser.xul) will hold on to // the leakref function an...

bootstrap.js - Extensions
for more information, see bootstrapped extensions. the example below contains the required methods in vsdoc format. ...

Sending form data - Learn web development
ous characters. the specific characters you should be cautious with vary depending on the context in which the data is used and the server platform you employ, but all server-side languages have functions for this. things to watch out for are character sequences that look like executable code (such as javascript or sql commands). limit the incoming amount of data to allow only what's necessary. sandbox uploaded files. store them on a different server and allow access to the file only through a different subdomain or even better through a completely different domain. you should avoid many/most problems if you follow these three rules, but it's always a good idea to get a security review performed by a competent third party. don't assume that you've seen all the possible problems. summary as ...

Adding vector graphics to the Web - Learn web development
er the extra overhead is really worthwhile, just to support obsolescent browsers. how to embed an svg with an <iframe> you can open svg images in your browser just like webpages. so embedding an svg document with an <iframe> is done just like we studied in from <object> to <iframe> — other embedding technologies. here's a quick review: <iframe src="triangle.svg" width="500" height="500" sandbox> <img src="triangle.png" alt="triangle with three unequal sides" /> </iframe> this is definitely not the best method to choose: cons iframes do have a fallback mechanism, as you can see, but browsers only display the fallback if they lack support for iframes altogether. moreover, unless the svg and your current webpage have the same origin, you cannot use javascript on your main webpage...

Working with Svelte stores - Learn web development
it. implementing our custom todos store our to-do list app is not particularly complex, so we won't move all our modification methods into a central place. we'll just leave them as they are, and instead concentrate on persisting our todos. note: if you are following this guide working from the svelte repl you won't be able to complete this step. for security reasons the svelte repl works in a sandboxed environment which will not let you access web torage, and you will get a "the operation is insecure" error. in order to follow this section you'll have to clone the repo and go to the mdn-svelte-tutorial/06-stores folder or you can directly download the folder's content with npx degit opensas/mdn-svelte-tutorial/06-stores. so, to implement a custom store that saves its content to web storage,...

Debugging Chrome
s using apitrace. i copied the d3d9.dll into both c:\users\jrmuizel\appdata\local\google\chrome sxs\application\22.0.1186.0 and c:\users\jrmuizel\appdata\local\google\chrome sxs\application\. i'm not sure which is needed. i did trace_file=foo.txt and it created the trace file in "c:\users\jrmuizel\appdata\local\google\chrome sxs\application\22.0.1183.0\foo.txt". i needed to run chrome using --no-sandbox. i was then able to run pix on d3dretrace. ...

Debugging on Windows
s. this is particularly useful to avoid linking layout with debugging information. console debugging when printing to stdout from a content process, the console message will not appear on windows. one way to view it is simply to disable e10s (./mach run --disable-e10s) but in order to debug with e10s enabled one can run ./mach run ... 2>&1 | tee it may also be necessary to disable the content sandbox (moz_disable_content_sandbox=1 ./mach run ...). running two instances of mozilla simultaneously you can run two instances of mozilla (e.g. debug and optimized) simultaneously by setting the environment variable moz_no_remote: set moz_no_remote=1 or, starting with firefox 2 and other gecko 1.8.1-based applications, you can use the -no-remote command-line switch instead (implemented in bug 325...

Makefile - variables
ogenerated. test_dirs a list of directories containing test makefiles tool_dirs a list of directories to process makefile 'tool' targets in. moz_ variable description moz_auto_deps moz_build_app moz_build_projects build multiple projects in the same sandbox. dest=$(moz_objdir)/$project moz_current_project moz_debug moz_enable_xremote moz_feeds moz_help_viewer moz_native_nspr moz_metro moz_pkg_mainfest moz_preflight_all m...

Gecko Logging
file logging output can be redirected to a file by passing its path via an environment variable. by default logging output goes to stderr. set moz_log_file="log.txt" the rotate and append options described above only apply when logging to a file. the special pref logging.config.log_file can be set at runtime to change the log file being output to. e10s note when a content process is in sandbox, it cannot write to stderr or any file. you may need to set preference security.sandbox.content.level to 0 to see the log. rust we're gradually adding more rust code to gecko, and rust crates typically use a different approach to logging. many rust libraries use the log crate to log messages, which works together with env_logger at the application level to control what's actually printed via ru...

Frame script environment
d on the global: instead, top-level variables are stored in a special per-script object that delegates to the per-tab global. this means you don't have to worry about global variables you define conflicting with global variables defined by another frame script. you can still access the global directly via this. frame scripts run with system principals. if you want other principals, you can use a sandbox. frame scripts run with system privileges and have access to the components object, enabling them to use xpcom objects and jsms. however, some apis that work in the chrome process will not work in a frame script. see limitations of frame scripts for more details. events besides the regular dom events being captured/bubbling up from content the current content object the following additional e...

Limitations of frame scripts
just work. xhr and workers will work. however, some apis that work in the chrome process will not work in a frame script. this article lists the most important of these apis. this is one of a pair of articles: the other one lists limitations of chrome scripts. security restrictions on file access processes that host remote content are isolated from the local system through a content security sandbox. one of the functions of the sandbox is to restrict access to the local file system by processes that host remote content. since frame and process scripts often execute in remote content processes these scripts are subject to the same file access rules placed on remote content. therefore frame scripts should not attempt to access the local file system directly, as these calls will fail. examples...

Frame script environment
red in a special per-script object that delegates to the per-tab global. this means you don't have to worry about global variables you define conflicting with global variables defined by another frame script. you can still access the global directly using this. frame scripts run with system principals. if you want other principals or when interacting with untrusted page scripts, you should use a sandbox. frame scripts run with system privileges and have access to the components object, enabling them to use xpcom objects and jsms. however, some apis that work in the chrome process do not work in a frame script. see limitations of frame scripts for more details. events besides the regular dom events being captured/bubbling up from content the current content object the following additional even...

Frame script loading and lifetime
loaded as soon as loadframescript() is called. if you've set allowdelayedload, the script is loaded into a new tab as soon as it is created. frame scripts are associated with a browser tab and not with a page. so once you load them, they will stay loaded until the tab is closed, even if you reload the document or navigate. if you want to limit a script to the lifetime of a page you can create a sandbox instead, where the current content page is used as prototype. if you want a frame script to do something when a new document is loaded, you need to listen for an appropriate dom event, generally domwindowcreated, domcontentloaded, or load. unloading frame scripts frame scripts are automatically unloaded when their hosting tab is closed. there is currently no way to unload them when loaded, oth...

Performance
remove interactive ui elements that would be inert with the addon ...

DMD
ocess environment variable, which can take the following values. unset: log all processes. "default": log the parent process only. "tab": log content processes only. for example, if you have moz_dmd_shutdown_log=~/dmdlogs/ moz_dmd_log_process=tab then dmd logs for content processes will be saved to ~/dmdlogs/. note: to dump dmd data from content processes, you'll need to disable the sandbox moz_dmd_shutdown_log must (currently) include the trailing separator (''/") post-processing dmd.py also takes options that control how it works. run dmd.py -h for documentation. the following options are the most interesting ones. -f / --max-frames. by default, records show up to 8 stack frames. you can choose a smaller number, in which case more allocations will be aggregated into each...

Refcount tracing and balancing
er figure out where refcounting went wrong. how to build for refcount tracing build with --enable-debug or --enable-logrefcnt. how to run with refcount tracing on there are several environment variables that can be used. first, you select one of three environment variables to choose what kind of logging you want. you almost certainly want xpcom_mem_refcnt_log. note: due to an issue with the sandbox on windows (bug 1345568), refcount logging currently requires the moz_disable_content_sandbox environment variable to be set. xpcom_mem_refcnt_log setting this environment variable enables refcount tracing. if you set this environment variable to the name of a file, the log will be output to that file. you can also set it to 1 to log to stdout or 2 to log to stderr, but these logs are larg...

Statistics API
e collection took, along with some related data. there are several ways to get access to this data: the environment variable moz_gctimer controls text dumping of gc stats. moz_gctimer may be none, stderr, stdout, or a filename. if a filename is given, data is appended to that file. when logging to a file is used in combination with multi-process firefox (e10s) it is necessary to set security.sandbox.content.level = 0, otherwise the content process will crash. the browser preference javascript.options.mem.log controls dumping of human-readable gc stats messages to the developer console. the browser preference javascript.options.mem.notify controls emission of json encoded gc stats to an observer interface. json api addons can obtain the complete data in json format via an observer. the f...

Introduction to the JavaScript shell
dumpheap([filename[, start[, tofind[, maxdepth[, toignore]]]]]) added in spidermonkey 1.8 dump the graph of all existing objects (or a specific interesting subgraph) to a file. for more information, see the c/c++ version of this function, js_dumpheap. evalcx(string[, object]) evaluates the javascript code in string. if object is specified, the code is executed in that object, treating it as a sandbox. if string is empty and object is not specified, evalcx() returns a new object with eager standard classes. if string is "lazy" and object is not specified, evalcx() returns a new object with lazy standard classes. note: evalcx() is only useful for people doing deep internal work on the javascript engine, for testing evalinsandbox-like environments in the shell. gc() runs the garbage collect...

Shell global objects
uments are not the same (both +0 or both -0, both nan, or non-zero and ===). starttimingmutator() start accounting time to mutator vs gc. stoptimingmutator() stop accounting time to mutator vs gc and dump the results. throwerror() throw an error from js_reporterror. intern(str) internalize str in the atom table. getslx(obj) get script line extent. evalcx(s[, o]) evaluate s in optional sandbox object o. if (s == '' && !o) return new o with eager standard classes, if (s == 'lazy' && !o) return new o with lazy standard classes evalinworker(str) evaluate str in a separate thread with its own runtime. getsharedarraybuffer() retrieve the sharedarraybuffer object from the cross-worker mailbox. the object retrieved may not be identical to the object that was installed, but it references t...

Using XPCOM Components
reezing the interfaces that are implemented by these components is still ongoing. the component viewer does not distinguish between components that are frozen and those that are not. in the source code you view in mxr, interfaces that have been frozen are marked at the top with @status frozen. the xpcom component viewer the xpcom component viewer is an add-on you can install in your browser (in sandbox, not available for now). alternatively, you can try xpcomviewer, a similar add-on. xpcom component viewer the left column shows the components - in this case a subset returned from a search on "gfx" as part of the contract id and the right column a list of the interfaces. when you open a component on the left, you can see the interfaces it implements along with a list of the methods provided...

Components.utils.evalInWindow
vileged code, such as add-on code, to access variables and apis defined in web content. even so, while the code is being evaluated it is in the content's context, so the caller has to be prepared for the possibility that the content could have redefined behavior (for example, a setter in the script may have been redefined to do something unexpected). this function is made available as a global in sandboxes which have the wantexporthelpers option set in the sandbox() constructor. syntax var result = components.utils.evalinwindow(script, window); parameters script : string the script to evaluate in the other window. window : object the window in which to evaluate the script. returns the result of evaluating the script. if this is just native (for example, a dom node), then the fu...

Components.utils.exportFunction
d to less-privileged code can be called from the less privileged code's context. the function has access to its surrounding closure just as if it were being called in the privileged context. the exported function does not have to be added to the less privileged code's global window object: it can be exported to any object in the target scope. exportfunction() is made available as a global in sandboxes which have the wantexporthelpers option set in the sandbox() constructor. this includes add-on sdk content scripts. to understand what happens if the functions you export accept arguments, see exporting functions that take arguments below. syntax components.utils.exportfunction(func, targetscope[, options]); parameters func : function the function to export. targetscope : object the o...

Components.utils.importGlobalProperties
imports various objects into a system scope. system scopes such as jsms and frame scripts don't have certain objects, such as indexeddb and xmlhttprequest, that are available to dom window globals. using this api you can import these objects into such a system scope. this function is not intended for sandboxes but for system-privileged scopes. to import these objects into a sandbox, use the wantglobalproperties option in the sandbox constructor. this function is passed an array of strings. each string is the name of an object to import, and will be defined on the importing scope's global. the following strings are supported: string/object xpcom component atob blob btoa crypto css fetch ...

Observer Notifications
network:offline-status-changed called when the offline state has changed. note: the data value for this notification 'offline' or 'online' to indicate the new state. network:link-status-changed called when the network link status changes. http requests these are the topics that you can observe during a http request (see setting http request headers and creating sandboxed http connections). both are passed an nsihttpchannel as the subject parameter. topic description http-on-modify-request called as a http request is made. the channel is available to allow you to modify headers and such. see this code snippet to learn how to get the tab that issued the request. http-on-opening-request similar to http-on-modify-request, but ca...

nsIParserUtils
or the fragment parsing algorithm. return value an nsidomdocumentfragment object for the resulting sanitized document fragment. sanitize() parses a string into an html document, sanitizes the document, and returns the result serialized to a string. the sanitizer is designed to protect against xss when sanitized content is inserted into a different-origin context without an iframe-equivalent sandboxing mechanism. by default, the sanitizer doesn't try to avoid leaking information that the content was viewed to third parties. that is, by default, for example <img> with a source pointing to an http server potentially controlled by a third party is not removed. to avoid ambient information leakage upon loading the sanitized content, use the sanitizerinternalembedsonly flag. in that case, <a> li...

WebIDL bindings
ble] used to flag a method that, when called, will not have the same-origin constraint tested: it can be called from a context with a different origin. [securecontext] we implement the standard extended attribute with a few details specific to gecko: system principals are considered secure. an extension poking at non-secured dom objects will see apis marked with [securecontext]. xpconnect sandboxes doesn't see [securecontext] apis, but this may change in bug 1273687. [needssubjectprincipal], [getterneedssubjectprincipal], [setterneedssubjectprincipal] used to flag a method or an attribute that needs to know the subject principal. this principal will be passed as argument. if the interface is not exposed on any worker global, the argument will be a nsiprincipal& because a subject princ...

Mozilla
ol comes from the fact that there is more than one way to achieve any given visual effect in a browser. so, if the effect of complex markup is being tested, put that complex markup into a page and create another page that uses simple markup to achieve the same visual effect. reftest will then compare them and verify whether they produce the same bitmap. creating sandboxed http connections starting with gecko 1.8.1 (firefox 2), it is possible to create sandboxed http connections which don't affect the user's cookies. this article will cover the basics of doing http connections from xpcom javascript, and should easily translate to c++ xpcom. debugging debugging a project as large as...

DOMTokenList - Web APIs
it is indexed beginning with 0 as with javascript array objects. domtokenlist is always case-sensitive. properties domtokenlist.length read only is an integer representing the number of objects stored in the object. domtokenlist.value a stringifier property that returns the value of the list as a domstring. ...

Document.domain - Web APIs
, as used by the same origin policy. if this property is successfully set, the port part of the origin is also set to null. syntax const domainstring = document.domain document.domain = domainstring value the domain portion of the current document's origin. ...

Document.requestStorageAccess() - Web APIs
nted, and rejects if access was denied. conditions for granting storage access storage access is granted based on a series of checks described here: if the document already has been granted access, resolve. if the document has a null origin, reject. if the document's frame is the main frame, resolve. if the sub frame's origin is equal to the main frame's, resolve. if the sub frame is not sandboxed, skip to step 7. if the sub frame doesn't have the token allow-storage-access-by-user-activation, reject. if the sub frame's parent frame is not the top frame, reject. if the browser is not processing a user gesture, reject. check any additional rules that the browser has. examples: allow lists, block lists, on-device classification, user settings, anti-clickjacking heuristics, or prompting...

FileSystem - Web APIs
ory entries api interface filesystem is used to represent a file system. these objects can be obtained from the filesystem property on any file system entry. some browsers offer additional apis to create and manage file systems, such as chrome's requestfilesystem() method. this interface will not grant you access to the users filesystem. instead you will have a "virtual drive" within the browser sandbox. if you want to gain access to the users filesystem you need to invoke the user by eg. installing a chrome extension. the relevant chrome api can be found here. basic concepts there are two ways to get access to a filesystem object: you can directly ask for one representing a sandboxed file system created just for your web app directly by calling window.requestfilesystem(). if that call is ...

File and Directory Entries API support in Firefox - Web APIs
non-standard this feature is non-standard and is not on a standards track. do not use it on production sites facing the web: it will not work for every user. there may also be large incompatibilities between implementations and the behavior may change in the future. the original file system api was created to let browsers implement support for accessing a sandboxed virtual file system on the user's storage device. work to standardize the specification was abandoned back in 2012, but by that point, google chrome included its own implementation of the api. over time, a number of popular sites and web applications came to use it, often without providing any means of falling back to standard apis or even checking to be sure the api is available before using it. mozilla ...

MediaDevices.getUserMedia() - Web APIs
f the obvious security concern associated with getusermedia() if used unexpectedly or without security being carefully managed, it can only be used in secure contexts. there are a number of insecure ways to load a document that might, in turn, attempt to call getusermedia(). the following are examples of situations in which getusermedia() is not permitted to be called: a document loaded into a sandboxed <iframe> element cannot call getusermedia() unless the <iframe> has its sandbox attribute set to allow-same-origin. a document loaded using a data:// or blob:// url which has no origin (such as when one of these urls is typed by the user into the address bar) cannot call getusermedia(). these kinds of urls loaded from javascript code inherit the script's permissions. any other situation in wh...

Pointer Lock API - Web APIs
"#f00"; ctx.beginpath(); ctx.arc(x, y, radius, 0, degtorad(360), true); ctx.fill(); } iframe limitations pointer lock can only lock one iframe at a time. if you lock one iframe, you cannot try to lock another iframe and transfer the target to it; pointer lock will error out. to avoid this limitation, first unlock the locked iframe, and then lock the other. while iframes work by default, "sandboxed" iframes block pointer lock. the ability to avoid this limitation, in the form of the attribute/value combination <iframe sandbox="allow-pointer-lock">, is expected to appear in chrome soon. specifications specification status comment pointer lock candidate recommendation initial specification. ...

window.dump() - Web APIs
t sent to the browser console. output can be sent to the browser console using console.log(). privileged code can also use components.utils.reporterror and nsiconsoleservice to log messages to the error console/browser console. dump() is also available to xpcom components implemented in javascript, even though window is not the global object in components. it is also explicitly made available in sandboxes. however, this use of dump is not affected by the preference mentioned below -- it will always be shown. it is therefore advisable to either check this preference yourself or use a debugging preference of your own to make sure you don't send lots of debugging content to a user's console when they might not be interested in it at all. note that dump output from xpcom components goes to stderr, w...

Window.requestFileSystem() - Web APIs
the returned filesystem is then available for use with the other file system apis. even compared to the rest of the file and directory entries api, requestfilesystem() is especially non-standard; only chrome implements it, and all other browser makers have decided that they will not implement it. it has even been removed from the proposed specification. ...

init() - Web APIs
criptcontext, in nsiglobalobject globalobject, in nsiuri baseuri, [optional] in nsiloadgroup loadgroup ); parameters principal the principal to use for the request; this must not be null. scriptcontext the script context to use for the request; this must not be null. globalobject the object to use as the global for our request. often, this is the outer window, but it may also be a sandbox or backstage pass. this may be null, but if it is, the request cannot create a document. prior to firefox 23, this was always a window. baseuri the base uri to use when resolving relative uris when handling the request. this may be null. loadgroup optional an optional load group used when performing the request. if this is specified, it is used even if the global has a window with a load gr...

HTML5 - Developer guides
traint validation api, several new attributes, new values for the <input> attribute type and the new <output> element. new semantic elements beside sections, media and forms elements, there are numerous new elements, like <mark>, <figure>, <figcaption>, <data>, <time>, <output>, <progress>, or <meter> and <main>, increasing the number of valid html5 elements. improvement in <iframe> using the sandbox and srcdoc attributes, authors can now be precise about the level of security and the wished rendering of an <iframe> element. mathml allows directly embedding mathematical formulas. introduction to html5 this article introduces how to indicate to the browser that you are using html5 in your web design or web application. html5 reference guide quick-reference html5 sheet containing markup g...

HTML attribute reference - HTML: Hypertext Markup Language
red <input>, <select>, <textarea> indicates whether this element is required to fill out or not. reversed <ol> indicates whether the list should be displayed in a descending order instead of a ascending. rows <textarea> defines the number of rows in a text area. rowspan <td>, <th> defines the number of rows a table cell should span over. sandbox <iframe> stops a document loaded in an iframe from using certain features (such as submitting forms or opening new windows). scope <th> defines the cells that the header test (defined in the th element) relates to. scoped <style> selected <option> defines a value which will be selected on page load. shape <a>, <area> siz...

Access-Control-Allow-Origin - HTTP
origin can be specified. if the server supports clients from multiple origins, it must return the origin for the specific client making the request. null specifies the origin "null". note: null should not be used: "it may seem safe to return access-control-allow-origin: "null", but the serialization of the origin of any resource that uses a non-hierarchical scheme (such as data: or file:) and sandboxed documents is defined to be "null". many user agents will grant such documents access to a response with an access-control-allow-origin: "null" header, and any origin can create a hostile document with a "null" origin. the "null" value for the acao header should therefore be avoided." examples a response that tells the browser to allow code from any origin to access a resource will include ...

CSP: object-src - HTTP
e http content-security-policy object-src directive specifies valid sources for the <object>, <embed>, and <applet> elements. to set allowed types for <object>, <embed>, and <applet> elements, use the plugin-types directive. elements controlled by object-src are perhaps coincidentally considered legacy html elements and aren't receiving new standardized features (such as the security attributes sandbox or allow for <iframe>). therefore it is recommended to restrict this fetch-directive (e.g. explicitly set object-src 'none' if possible). csp version 1 directive type fetch directive default-src fallback yes. if this directive is absent, the user agent will look for the default-src directive. syntax one or more sources can be allowed for the object-src...

Index - HTTP
ate the content security policy. these violation reports consist of json documents sent via an http post request to the specified uri. 45 csp: require-sri-for csp, directive, http, reference, security the http content-security-policy require-sri-for directive instructs the client to require the use of subresource integrity for scripts or styles on the page. 46 csp: sandbox csp, directive, http, security the http content-security-policy (csp) sandbox directive enables a sandbox for the requested resource similar to the <iframe> sandbox attribute. it applies restrictions to a page's actions including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy. 47 csp: script-src csp, directive, http,...

HTTP Index - HTTP
lation reports consist of json documents sent via an http post request to the specified uri. 96 csp: require-sri-for csp, directive, http, reference, security, subresource integrity, require-sri-for the http content-security-policy require-sri-for directive instructs the client to require the use of subresource integrity for scripts or styles on the page. 97 csp: sandbox csp, content-security-policy, directive, http, sandbox, security the http content-security-policy (csp) sandbox directive enables a sandbox for the requested resource similar to the <iframe> sandbox attribute. it applies restrictions to a page's actions including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy. 98 csp: sc...

eval() - JavaScript
e later parsed as json. pass data instead of code for example, an extension designed to scrape contents of web-pages could have the scraping rules defined in xpath instead of javascript code. run code with limited privileges if you must run the code, consider running it with reduced privileges. this advice applies mainly to extensions and xul applications, which can use components.utils.evalinsandbox for this. examples using eval in the following code, both of the statements containing eval() return 42. the first evaluates the string "x + y + 1"; the second evaluates the string "42". var x = 2; var y = 39; var z = '42'; eval('x + y + 1'); // returns 42 eval(z); // returns 42 using eval to evaluate a string of javascript statements the following example uses eval() to evaluate...

WebAssembly Concepts - WebAssembly
ar-native speed across different platforms by taking advantage of common hardware capabilities. be readable and debuggable — webassembly is a low-level assembly language, but it does have a human-readable text format (the specification for which is still being finalized) that allows code to be written, viewed, and debugged by hand. keep secure — webassembly is specified to be run in a safe, sandboxed execution environment. like other web code, it will enforce the browser's same-origin and permissions policies. don't break the web — webassembly is designed so that it plays nicely with other web technologies and maintains backwards compatibility. note: webassembly will also have uses outside web and javascript environments (see non-web embeddings). how does webassembly fit into the we...