Simon Willison's Weblog: greasemonkey

Wildcard: Spreadsheet-Driven Customization of Web Applications

2020-02-28T19:39:31+00:00

Wildcard: Spreadsheet-Driven Customization of Web Applications

What a fascinating collection of ideas. Wildcard is a browser extension (currently using Tampermonkey and sadly not yet available to try out) which lets you add “spreadsheet-driven customization” to any web application. Watching the animated screenshots in the videos helps explain what this mean—essentially it’s a two-way scraping trick, where content on the page (e.g. Airbnb listings) are extracted into a spreadsheet-like table interface using JavaScript—but then interactions you make in that spreadsheet like filtering and sorting are reflected back on the original page. It even has the ability to serve editable cells by mapping them to form inputs on the page. Lots to think about here.

Via Hacker News

Tags: greasemonkey, spreadsheets

OCR and Neural Nets in JavaScript

2009-01-25T00:00:28+00:00

OCR and Neural Nets in JavaScript

John dissects the brilliant Greasemonkey script that solves simple captchas using the canvas element and HTML5’s getImageData API.

Tags: canvas, captchas, getimagedata, greasemonkey, javascript, john-resig, ocr

Crowbar

2009-01-24T23:52:55+00:00

Crowbar

Headless Gecko/XULRunner which exposes a web service API for screen scraping using a real browser DOM—just pass it the URL of a page and the URL of a screen scraping JavaScript script (a bit like a Greasemonkey user script) and get back RDF/XML.

Tags: crowbar, dom, gecko, greasemonkey, mozilla, rdf, scraping, webservice, xml, xulrunner

BUG: XSS Security flaw in BaseCamp Messages

2008-06-26T09:39:20+00:00

BUG: XSS Security flaw in BaseCamp Messages

BaseCamp lets users include HTML and JavaScript in messages, on the basis that anyone with a BaseCamp account is a trusted party. I’m not convinced: you could use this to circumvent BaseCamp’s access control stuff and read messages you’re not meant to. On the flip side, you could also use this to add brand new features to BaseCamp by using JavaScript in a message as a server-side equivalent to Greasemonkey.

Via Hacker News

Tags: 37signals, basecamp, greasemonkey, javascript, security, xss

google-axsjax

2007-11-14T17:18:38+00:00

google-axsjax

“The AxsJAX framework can inject accessibility enhancements into existing Web 2.0 applications using any of several standard Web techniques”—including bookmarklets and Greasemonkey. The enhancements conform to W3C ARIA, supported by Firefox 2.0 and later.

Via Google Code Blog

Tags: accessibility, ajax, aria, axsjax, bookmarklets, firefox, google, greasemonkey, javascript, w3c

Gmail Greasemonkey API

2007-11-07T10:38:38+00:00

Gmail Greasemonkey API

The new version of Gmail includes API hooks for Greasemonkey script authors. The documentation is by Mark Pilgrim, author of Greasemonkey Hacks.

Via Mihai Parparita

Tags: gmail, google, greasemonkey, javascript, mark-pilgrim, mihai-parparita

Site-specific browsers and GreaseKit

2007-10-25T07:56:01+00:00

Site-specific browsers and GreaseKit

New site-specific browser tool which lets you include a bunch of Greasemonkey scripts. For me, the killer feature of site-specific browsers is still cookie isolation (to minimise the impact of XSS and CSRF holes) but none of the current batch of tools advertise this as a feature, and most seem to want to share the system-wide cookie jar.

Tags: chris-messina, cookies, csrf, greasekit, greasemonkey, javascript, safari, security, sitespecificbrowsers, webkit, xss

Anyone who recently downloaded GreaseMonkey scripts from userscripts.org should check their scripts

2007-07-07T22:43:39+00:00

Anyone who recently downloaded GreaseMonkey scripts from userscripts.org should check their scripts

I haven’t confirmed this, but this Jyte claim suggests that userscripts.org was hacked and cookie stealing code inserted in to some of the scripts. UPDATE: Not hacked; just bad scripts submitted through the regular process.

Tags: greasemonkey, jyte, security, userscripts

Greasemonkey 0.6.5 - 2.0 support and localization

2006-07-28T08:47:07+00:00

Greasemonkey 0.6.5 - 2.0 support and localization

First release in nearly 8 months. Great to see it’s still ticking over.

Tags: greasemonkey, l10n

Campfire Bot

2006-02-26T06:18:51+00:00

Campfire Bot

Campfire + Greasemonkey = Bot. How long until there’s a Google Talk one of these?

Tags: greasemonkey

Canvas demos

2005-10-05T16:43:36+00:00

Jesse Andrews (of Book Burro and userscripts.org fame) has built some awesome canvas demos for users of Safari or Firefox 1.5. He has a bar chart and some animated rectangles, but the real gem is the live chart which polls a server using XMLHttpRequest and updates a line graph with live data. He also has some fun mathematical experiments: a cellular automata generator and a neat exploration of Lindenmayer systems (both static and interactive). Read more on his blog.

Tags: canvas, firefox, greasemonkey, jesse-andrews

More fun with the monkey

2005-09-17T19:44:56+00:00

Cory Doctorow points to America from the Great Depression to World War II: Color Photographs from the FSA-OWI, 1939-1945, with the following observation:

Unfortunately, the organizational back-end for this is so primitive (especially in comparison with modern image-sharing and organizing sites like Flickr) that it, too, seems to hail from 1939-1945, making the site a real pain to navigate and use.

Thanks to Greasemonkey, great content spoiled by poor navigation is a solvable problem.

americanmemoryfixer.user.js includes the following improvements:

Changes the colour scheme to black-on-white, and the typeface to Verdana.
Removes all table borders.
Adds headings to some pages, and fixes various title tags.
Sets the default gallery view to be a set of thumbnails, rather than a list of names.
Displays a large image (as opposed to a thumbnail) when you view a photograph.

The scariest hack in the script is the way in which subject page titles are passed around. In the current site, if you visit a category page (such as Sharecroppers) the title of the category is not displayed on the page - even though it has been passed as a parameter in the URL. If you click a link (say to the Galley thumbnail page) the information in the URL is lost as well.

My solution was to extract the subject from the URL on that first page, then rewrite the other links to include an additional "&subject=Sharecroppers" parameter. This new parameter is ignored by the CGI scripts that power the site, but my Greasemonkey script watches out for it on subsequent pages and uses it to display a title (and further propagate it to other links on the page). It's not a very robust solution, but it's good enough.

There's plenty of scope for further improvement - if you want to use my script as a starting point, please feel free.

Tags: cory-doctorow, greasemonkey

scribbly

2005-09-13T01:03:44+00:00

scribbly

Greasemonkey + canvas.

Tags: greasemonkey

Firefox 1.5-compatible Greasemonkey beta now available

2005-09-13T00:48:38+00:00

Firefox 1.5-compatible Greasemonkey beta now available

I’d been waiting for this.

Tags: firefox, greasemonkey

[Greasemonkey] Monkey Do

2005-08-18T17:39:09+00:00

[Greasemonkey] Monkey Do

User script that automatically posts interesting things to del.icio.us.

Tags: delicious, greasemonkey

Chapter 4. Common Patterns [Dive Into Greasemonkey]

2005-08-12T17:56:08+00:00

Chapter 4. Common Patterns [Dive Into Greasemonkey]

Greasemonkey patterns.

Tags: greasemonkey

MagicLine

2005-08-04T16:32:40+00:00

MagicLine

Greasemonkey + microformats killer app. You just HAVE to check this out.

Tags: greasemonkey, microformats

Jeff Barr on Greasemonkey

2005-08-02T11:55:45+00:00

Jeff Barr on Greasemonkey

Greasemonkey for "Enterprise Application Integration".

Despite the odd name, Greasemonkey embodies a very cool and somewhat unique concept, something that I am starting to think of as low-budget, client-side application integration. In the late 90’s, “EAI” or Enterprise Application Integration, was all the rage. Companies that had the need to make disparate applications work together would spend tens of thousands of dollars on complex, fragile software to make it happen. Sometimes it worked, and sometimes it didn’t. When it didn’t, they would call in armies of even more expensive consultants.

Now, I’ll be the first to say that Greasemonkey in its present form isn’t quite ready to replace expensive, commercial EAI software. However, I do believe that it belongs in the enterprise developer’s tookit of possible solutions, and I also believe that Greasemonkey will gain features, power, and respect over the coming months and that now is the time to learn more about it.

Tags: greasemonkey, jeff-barr

[Greasemonkey] A whole other kind of monkey

2005-07-20T19:56:40+00:00

[Greasemonkey] A whole other kind of monkey

Help Aaron test the new, hopefully secure, Greasemonkey.

Tags: greasemonkey

Understanding the Greasemonkey vulnerability

2005-07-20T03:09:19+00:00

If you have any version of Greasemonkey installed prior to 0.3.5, which was released a few hours ago, or if you are running any of the 0.4 alphas, you need to go and upgrade right now. All versions of Greasemonkey aside from 0.3.5 contain a nasty security hole, which could enable malicious web sites to read any file from your hard drive without you knowing.

Unfortunately, 0.3.5 disables all of the GM_ API functions, without which many of the more interesting user scripts out there simple won't work. This is a temporary measure - the GM_ functions should return in a later release, once the security problem with them has been resolved.

I'm going to explain how the vulnerability works, because it illustrates a number of interesting concepts in both web application security and JavaScript.

Same-origin policy

JavaScript has always enforced a same-origin policy for scripts loaded over the internet. This originally applied to scripting between frames (and iframes): a script loaded from a certain domain is only allowed to access the DOM of other pages loaded from that same domain. The same restriction has been extended to XMLHttpRequest - you are only allowed to make an XMLHttpRequest call back to the domain from which the script was originally loaded.

This policy exists to prevent cross-domain attacks. Say for example you work for a company with an intranet hidden behind the firewall, full of interesting proprietary information. Without the same-origin policy, malicious sites that you visit on the public internet would be able to read information from your intranet, using your browser as the middle-man.

GM_xmlhttpRequest

The GM_xmlhttpRequest API function does not have this restriction - it can load data from any domain. This enables a whole host of interesting user scripts - the most famous of which is probably Book Burro, which shows comparison prices from different online stores for the item you are currently looking at on Amazon, Barnes and Noble and more.

Malicious user scripts could use this feature to steal information from your private intranet, but malicious user scripts could also do all manner of other nasty things - stealing your Hotmail password for example. This is why you should never install a user script from an untrusted source without first reviewing the code.

Restricting API functions to user scripts only

To keep things safe then, it is essential that the GM_ family of API functions can only ever be used by user scripts, not by code running on pages that you have visited. By installing a user script you have declared it trustworthy - but visiting a web page does not carry that contract.

The way the flawed versions of Greasemonkey do that now is simple: the GM_ functions are added to the JavaScript global object (which is the window object), the user scripts for the page are "injected" using dynamically created <script> elements, they run, then the GM_ functions are removed from the global object to prevent scripts on the page from accessing them. This works because Greasemonkey injection and execution happens just before the onload event is fired - which is when most well behaved scripts kick in.

Object.watch()

Here's the clever part: JavaScript 1.5 defines a method of the Object class (which is inherited by all other JavaScript objects) called watch. Watch is extremely powerful: it lets you register some code to be executed when a property on some other object is assigned. This is the key to the Greasemonkey vulnerability - by watching the window object for the point at which Greasemonkey adds the API functions, a malicious script can use those functions at the moment they are attached.

The file:// protocol

Here's the final piece of the puzzle: the file:// protocol in Firefox allows you to view files and directory listings in your browser. Unfortunately, it also allows the GM_xmlhttpRequest function to do the same. It's not at all hard for a malicious script to use the function to load in files at a known location - or even load in directory listings (as HTML), parse them and use them to find all kinds of things scattered around your hard drive.

Solving the problem

The principle problem then is the requirement for "safe" Greasemonkey API functions - that is, functions that can be used by the user scripts but not by code running on a website. Aaron is looking in to this right now - it looks like the solution will require a minor change to be made to many existing scripts, but the trade-off in terms of security is more than worth it. The GM_xmlhttpRequest function will also be modified to disallow file:// URLs.

Until then, 0.3.5 is the only safe version of Greasemonkey.

Tags: greasemonkey, javascript, security, xmlhttprequest

LUG Radio Live

2005-06-26T18:33:17+00:00

I've been very busy for the last three days. My last two exams (HCI and Marketing) were on Thursday evening and Friday morning respectively, followed by a celebratory barbecue. I was up at 7am on Saturday to get up to Wolverhampton for LUG Radio Live, then back to Bath again by 5.30pm for our graduation summer ball. Finally, I'm heading off to Denmark in the early hours of Monday morning for a week and a bit of camping and Roskilde Let's hope it's a bit drier than Glastonbury was.

LUG Radio Live was a huge success. I have no idea how many people showed up, but it was at least several hundred. I did a lightning talk on Greasemonkey (slides here) which seemed to go pretty well, and ended in a lively Q&A session. I've posted some of my photos from the event up on Flickr.

Mark Shuttleworth seamlessly combined a talk on Ubuntu, the importance of open source, collaborative development tools and what it's like to go in to space. He's a great speaker, and I thoroughly recommend seeing him talk if you ever get a chance. He also mentioned that he would be interesting in sponsoring a bounty towards the development of an open-source SubEthaEdit clone.

The LUG Radio team interviewed Ian Bell, the author of the original Elite. The most interesting revelation was that fitting the compiled Elite game in to 32K was actually easier than getting the uncompiled source code small enough to fit on the hosting architecture (they had to strip out all of the comments).

I met a bunch of interesting people and had a great time, even though I had to leave early to get back in time for the ball. Congratulations to all involved, and I look forward to going again next year.

Tags: conferences, greasemonkey, lugradio, lugradiolive, speaking, my-talks

Magic Microformat Forms Redux, Now with GreaseMonkey!

2005-06-09T23:18:00+00:00

Magic Microformat Forms Redux, Now with GreaseMonkey!

Les Orchard gets in to Greasemonkey—with accompanying screencast.

Tags: greasemonkey, les-orchard, microformats

Workplace absuridities as phone support for a DSL ISP

2005-06-09T23:01:03+00:00

Workplace absuridities as phone support for a DSL ISP

Greasemonkey used to fix web application leads to misguided Firefox ban.

Tags: greasemonkey

Tweaking Wikipedia

2005-06-06T18:13:44+00:00

Does anyone know why Wikipedia displays a redirected page at the same URL rather than using a proper HTTP redirect? Case in point: Topics in human-computer interaction actually displays the content from List of human-computer interaction topics (that's my next exam topic) - the same content appears at two different URLs. Yuck. Here's a Greasemonkey script to fix it: wikipedia-redirect.user.js.

While I'm at it, Wikipedia's search function is painfully slow. Here's another user script which changes their search button to search the site using Google instead. It also swaps the positions of the "Search" and "Go" buttons, and makes "Search" the default action for the form: wikipedia-googlesearch.user.js.

Tags: greasemonkey, wikipedia

Trixie: Greasemonkey for IE

2005-05-31T19:15:09+00:00

Trixie: Greasemonkey for IE

Second attempt—but it’s still closed source.

Via The Greasemonkey mailing list

Tags: greasemonkey, internet-explorer

[Greasemonkey] a difference in vision

2005-05-29T22:49:20+00:00

[Greasemonkey] a difference in vision

Check out the last paragraph. I got a kick out of it.

Tags: greasemonkey

Greasemonkey: Yet Another Reason to Use Firefox

2005-05-27T21:37:40+00:00

Greasemonkey: Yet Another Reason to Use Firefox

Great writeup of Greasemonkey on the PC World Techlog(!)

Tags: firefox, greasemonkey

Tweaking WordPress With Greasemonkey

2005-05-25T13:11:55+00:00

Tweaking WordPress With Greasemonkey

More application interface enhancements.

Via Photo Matt

Tags: greasemonkey, wordpress

Fixing web applications with Greasemonkey

2005-05-24T01:59:40+00:00

In Greasemonkey FUD, I highlighted the importance of Greasemonkey as a tool for fixing interface problems in "enterprise" web applications. DJ Adams has done exactly that for OSS Notes, part of the SAP service portal. His user script ditches the frames in the interface, makes the page title more useful and adds hyperlinks to other note references on the page - significantly improving the user experience in less than 40 lines of code. The improvements are clearly explained in the accompanying screencast.

Spotted via Jeremy on the Greasemonkey mailing list.

Tags: greasemonkey

Wired News: Firefox Users Monkey With the Web

2005-05-17T12:27:15+00:00

Wired News: Firefox Users Monkey With the Web

Greasemonkey on Wired—and I get quoted!

Tags: firefox, greasemonkey, press-quotes