Firefox扩展中的远程Js文件

Question

I am coding firefox add-on for my website visitors. I am trying to make that extension load remote javascript file, so visitors can change settings and options in their profile on website for addon, and addon loads it via remote js. Here is what i tried:

if(window.location.hostname=="link") {


    pagesload='http://link/file.js?v='+randnw;

    var req = new XMLHttpRequest();
    req.open('GET', pagesload, false); 
    req.send();
    var contents = req.responseText;
    eval(contents);
}

Answer 1

Don't!

Don't ever do something like that! This is a security nightmare (even if you'd run it just in a content script).

If you ever plan to publish the add-on, in the mozilla add-ons gallery (AMO) or not, as doing something like this would violate the Add-on Guidelines , your AMO submission would be rejected and/or your self-hosted add-on would be blocklisted for being unsafe upon discovery.

Why is this unsafe?

• The remote script you're loading will run in another, higher (security) context, which is show-stopper. When running in a content script, it might do everything what the content script can do incl. (abusively) messaging fully privileged SDK modules incl. main.js . When running in an SDK module, it would be fully privileged and can do whatever the system user account can do. Stealing all user cookies would be only a first step.
• The remote script can not be trusted, ever.
• When transmitted over http, an attacker might easily mount man-in-the-middle attacks.
• When transmitted over https, while man-in-the-middle attacks become far less feasible, the server operator can do whatever they want. And the server operator is not necessarily you yourself. The server might have been compromised in the meantime or ownership of the domain might have been transferred.

Instead

Instead of eval uating some remote script, only exchange data, such as JSON, XML, plain text, etc. and verify the data before using it (don't simply trust remote data).

How to retrieve

From an SDK module, incl. main.js , you may use the request or net/xhr module, both of which do not have a same-origin policy.

Content scripts can be made into cross-domain content scripts should the need arise, but they can use XMLHttpRequest for the same domain they are running on even without it.

Your question also has a snippet using synchronous XHR. Don't use synchronous XHR. It is strongly discouraged and considered a bad practice on the web, and even more so in add-ons (and not really officially supported there anyway).

Why doesn't the code from your question work?

No idea, you didn't provide enough details to reproduce the problem. Eg you haven't even mentioned where that code is supposed to work ( main.js , a content script, ...)