Share global data in Firefox through javascript implemented XPCOM

[Lei Sun]

Hi Guys,

I know there are docs and posts about this topic, and I have tried to
make them work, but I kept on getting exceptions like (Service
Manager::GetSerice returned failure code....)

I followed
* http://developer.mozilla.org/en/docs/Working_with_windows_in_chrome_code#Using_an_XPCOM_singleton_component
* http://groups.google.com/group/mozilla.dev.extensions/browse_thread/thread/52b6f2d04b5f9e6f/40806d7cc8c6314e?lnk=gst&q=xpcom+data&rnum=1#40806d7cc8c6314e
* http://ted.mielczarek.org/code/mozilla/jscomponentwiz/

I was able to create an xpcom component alright, but I would like to
have it have a custom interface that defines get(namespace, data),
set(namespace, data).

After reading "passing/getting data from/to custom xpcom service", I
got confused and stuck on:
1. Do I still need to create an IDL, and compile it into xpt? (I think~ I need)
2. If so, since I might be passing complex js objects into the XPCOM
to store, what variable type should I define? (Since I didn't see any
type for js objects, void?)
3. Should I do
var myService = Components.classes["@my.com/myService;1"]
.getService(Components.interfaces.nsISupports);
or
var myService = Components.classes["@my.com/myService;1"]
.getService();
Well, both of them are giving me the same errors. (I am on firefox
2.0.0.4 ubuntu)

Can someone please show me some working code or examples of how to
store and retrieve js objects from XPCOM component?

Thanks you so much!

Lei

[Ed]

Lei Sun wrote:
> 1. Do I still need to create an IDL, and compile it into xpt? (I think~
> I need)
> 2. If so, since I might be passing complex js objects into the XPCOM
> to store, what variable type should I define? (Since I didn't see any
> type for js objects, void?)

You don't need IDL. You will have to use the wrappedJSObject trick, though.

> 3. Should I do
> var myService = Components.classes["@my.com/myService;1"]
> .getService(Components.interfaces.nsISupports);
> or
> var myService = Components.classes["@my.com/myService;1"]
> .getService();

Either one should work.

> Well, both of them are giving me the same errors. (I am on firefox
> 2.0.0.4 ubuntu)

You could try shutting down firefox and deleting compreg.dat and
xpti.dat as described here:

http://developer.mozilla.org/en/docs/How_to_Build_an_XPCOM_Component_in_Javascript

[Nickolay Ponomarev]

On 6/25/07, Lei Sun <lei...@gmail.com> wrote:
> 3. Should I do
> var myService = Components.classes["@my.com/myService;1"]
> .getService(Components.interfaces.nsISupports);
> or
> var myService = Components.classes["@my.com/myService;1"]
> .getService();

> Well, both of them are giving me the same errors. (I am on firefox
> 2.0.0.4 ubuntu)
>

It doesn't matter - if you get an error here, your component did not
get registered. Have you read
http://developer.mozilla.org/en/docs/Troubleshooting_XPCOM_components_registration
?

Nickolay

[Lei Sun]

Hi All,

It worked after I removed the compreg.dat and xpti.dat in the profile
dir, and restarted the application.

Then my follow up question is:

Say, we are using reference to refer to this component. Are we able to
alter this component's inner implementations? (Please see the code
below)

in component's code:
function Test() {
// you can cheat and use this
// while testing without
// writing your own interface
this.wrappedJSObject = this;
}

// This is the implementation of your component.
Test.prototype = {
// for nsISupports
QueryInterface: function(aIID)
{
// add any other interfaces you support here
if (!aIID.equals(nsISupports))
throw Components.results.NS_ERROR_NO_INTERFACE;
return this;
},

hello: function() {
return {a: 'hello'};
}
}

in calling code:
var s = Components.classes["@my.com/myService;1"]
.getService().wrappedJSObject;
s.hello = function() {
// do something really bad, like stealing people's passwords... //
--- evil implementation
}

So if I do a

var s = Components.classes["@my.com/myService;1"]
.getService().wrappedJSObject;

again, Would that still have the evil implementation from the last
block of code? If so, How long will it last? Until the next
application restart? And how do I protect the component from being
evil used like this?

Lei

[Nickolay Ponomarev]

On 6/25/07, Lei Sun <lei...@gmail.com> wrote:
> Say, we are using reference to refer to this component. Are we able to
> alter this component's inner implementations? (Please see the code
> below)
>
> in component's code:
> function Test() {

> this.wrappedJSObject = this;

> }
>
> in calling code:
> var s = Components.classes["@my.com/myService;1"]
> .getService().wrappedJSObject;
> s.hello = function() {
> // do something really bad, like stealing people's passwords... //
> --- evil implementation
> }
>
> So if I do a
>
> var s = Components.classes["@my.com/myService;1"]
> .getService().wrappedJSObject;
>
> again, Would that still have the evil implementation from the last
> block of code?

Yes.

> If so, How long will it last? Until the next
> application restart?

Yes.

> And how do I protect the component from being
> evil used like this?
>

By avoiding the wrappedJSObject thing and exposing your component's
functionality via IDL interfaces instead.

Nickolay

>
> On 6/25/07, Nickolay Ponomarev <asqu...@gmail.com> wrote:
> > On 6/25/07, Lei Sun <lei...@gmail.com> wrote:
> > > 3. Should I do
> > > var myService = Components.classes["@my.com/myService;1"]
> > > .getService(Components.interfaces.nsISupports);
> > > or
> > > var myService = Components.classes["@my.com/myService;1"]
> > > .getService();
> > > Well, both of them are giving me the same errors. (I am on firefox
> > > 2.0.0.4 ubuntu)
> > >
> > It doesn't matter - if you get an error here, your component did not
> > get registered. Have you read
> > http://developer.mozilla.org/en/docs/Troubleshooting_XPCOM_components_registration
> > ?
> >
> > Nickolay
> >

> _______________________________________________
> dev-extensions mailing list
> dev-ext...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-extensions
>

[eric...@yahoo.com]

I think it's important to point out that the attack Lei describes can only be achieve from other privileged code; i.e., user-installed code, not arbitrary web sites. A user would have to install code specifically targeted at the custom XPCOM service in question.

[Lei Sun]

Hi Nickolay,

Hum... In that case, from the reference
http://developer.mozilla.org/en/docs/XPIDL:Syntax

what type should I declare in IDL? void?

Lei

[Lei Sun]

Hi Nick,

I tried to define void, but it didn't work.

Hi Eric,

The intension for this extension is actually to make user to install
local script easier? and I am trying to figure out a way, so that they
won't be stepping on each other, and I can have a guaranteed way to
get all of them fresh without restarting firefox.

Lei

On 6/25/07, Lei Sun <lei...@gmail.com> wrote:

[eric...@yahoo.com]

You might consider loading the local scripts with nsIScriptLoader since this creates a unique, separated namespace where variables and functions cannot step on each other.

----- Original Message ----
From: Lei Sun <lei...@gmail.com>
To: dev-ext...@lists.mozilla.org
Sent: Tuesday, June 26, 2007 1:53:12 AM
Subject: Re: Share global data in Firefox through javascript implemented XPCOM

Hi Nick,

Hi Eric,

Lei

[Neil]

Lei Sun wrote:

> 2. If so, since I might be passing complex js objects into the XPCOM
> to store, what variable type should I define?

You can't really do this, because the Object prototype for your custom
js objects is defined on your current window, which will go away when
the window is closed. If your objects have a consistent interface then
you can of course create them in your XPCOM component and retrieve them
from your UI code.

--
Warning: May contain traces of nuts.