Boris Zbarsky a écrit :
Marine wrote:
The webpage have to be able to expose some values/parameters to the
extension.
So I tried to add properties to button, to document or to window
objects, in my webpage.
The problem is that reading those from chrome would be exploitable (by
the webpage).
You can do it if you trust the webpage by looking at the wrappedJSObject
of the thing you're working with, instead of the thing itself. But make
sure you trust the webpage (e.g. that it's served over https from a
server you control).
-Boris
Thanks a lot Boris for your quick reply.
_______________________________________________
dev-security mailing list
dev-security@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security
