<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Mike Conley&#039;s Blog &#187; content.alert</title>
	<atom:link href="http://mikeconley.ca/blog/tag/contentalert/feed/" rel="self" type="application/rss+xml" />
	<link>http://mikeconley.ca/blog</link>
	<description>The personal blog of a Toronto based graduate student, software developer, musician, and theatre enthusiast.</description>
	<lastBuildDate>Tue, 07 Sep 2010 21:11:39 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>Overriding Firefox’s Window.Alert &#8211; Part 4</title>
		<link>http://mikeconley.ca/blog/2009/05/03/overriding-firefox%e2%80%99s-windowalert-part-4/</link>
		<comments>http://mikeconley.ca/blog/2009/05/03/overriding-firefox%e2%80%99s-windowalert-part-4/#comments</comments>
		<pubDate>Sun, 03 May 2009 21:42:12 +0000</pubDate>
		<dc:creator>Mike</dc:creator>
				<category><![CDATA[Computer Science]]></category>
		<category><![CDATA[Firefox Extensions]]></category>
		<category><![CDATA[Internet]]></category>
		<category><![CDATA[Javascript]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[alertCheck]]></category>
		<category><![CDATA[alert]]></category>
		<category><![CDATA[content.alert]]></category>
		<category><![CDATA[download]]></category>
		<category><![CDATA[extension]]></category>
		<category><![CDATA[firefox]]></category>
		<category><![CDATA[mozilla]]></category>
		<category><![CDATA[override]]></category>
		<category><![CDATA[window.alert]]></category>

		<guid isPermaLink="false">http://mikeconley.ca/blog/?p=392</guid>
		<description><![CDATA[So, I think I&#8217;m more or less done the extension. Someday, when I&#8217;ve got more extension development experience under my belt, I&#8217;ll probably come back to this and fix it up.  Until then, this will have to do. Click here to download. If you&#8217;re interested in looking at the source, just change the file extension [...]]]></description>
			<content:encoded><![CDATA[<p>So, I think I&#8217;m more or less done the extension.</p>
<p>Someday, when I&#8217;ve got more extension development experience under my belt, I&#8217;ll probably come back to this and fix it up.  Until then, this will have to do.</p>
<p><a href="https://addons.mozilla.org/en-US/firefox/addon/13176">Click here to download.</a></p>
<p>If you&#8217;re interested in looking at the source, just change the file extension from &#8220;.xpi&#8221; to &#8220;.zip&#8221;, and decompress.  It&#8217;s all there.</p>
<p>There&#8217;s no license on this thing, no GPL, MIT, nothing.  Use it however you want.  <strong>If you find it useful though, I&#8217;d love to hear from you</strong> &#8211; send me email, post a comment, Facebook, Twitter, whichever.</p>
<p>Whew.  I think I&#8217;m going to reward myself with some orange sherbet.  Om nom nom&#8230;</p>
<p>Here&#8217;s a really annoying website to test the extension with.  <strong>I really don&#8217;t recommend that you visit it without my extension installed</strong>.</p>
<p>The window hops around a bit, so just double click on the location bar, and type in something like &#8220;http://www.google.ca&#8221;.  This will start up the flood of alerts, and (hopefully) you&#8217;ll be able to suppress them after the first one hits.</p>
<p><a href="http://www.bringvictory.com/">Here&#8217;s the site.  Visit at your own risk.</a></p>
<p><strong>UPDATE:</strong></p>
<p>I&#8217;ve <a href="https://addons.mozilla.org/en-US/firefox/addon/13176">moved the extension to Mozilla Addons</a>, and added Firefox 3.5 compatibility.</p>
<p>I&#8217;ve updated alertCheck.xpi so that it&#8217;ll play nice with Firefox 3.0b5, and hopefully Firefox 3.1.*.  Let me know if there are any behaviour foulups, and I&#8217;ll do my best to fix them.</p>
]]></content:encoded>
			<wfw:commentRss>http://mikeconley.ca/blog/2009/05/03/overriding-firefox%e2%80%99s-windowalert-part-4/feed/</wfw:commentRss>
		<slash:comments>14</slash:comments>
		</item>
		<item>
		<title>Overriding Firefox’s Window.Alert &#8211; Part 3</title>
		<link>http://mikeconley.ca/blog/2009/05/03/overriding-firefox%e2%80%99s-windowalert-part-3/</link>
		<comments>http://mikeconley.ca/blog/2009/05/03/overriding-firefox%e2%80%99s-windowalert-part-3/#comments</comments>
		<pubDate>Sun, 03 May 2009 07:14:17 +0000</pubDate>
		<dc:creator>Mike</dc:creator>
				<category><![CDATA[Computer Science]]></category>
		<category><![CDATA[Firefox Extensions]]></category>
		<category><![CDATA[Internet]]></category>
		<category><![CDATA[Javascript]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[alertCheck]]></category>
		<category><![CDATA[alert]]></category>
		<category><![CDATA[content.alert]]></category>
		<category><![CDATA[contentWindow]]></category>
		<category><![CDATA[DOMContentLoaded]]></category>
		<category><![CDATA[DOMWillOpenModalDialog]]></category>
		<category><![CDATA[DoS]]></category>
		<category><![CDATA[firefox]]></category>
		<category><![CDATA[mozilla]]></category>
		<category><![CDATA[override]]></category>
		<category><![CDATA[window.alert]]></category>
		<category><![CDATA[wrappedJSObject]]></category>

		<guid isPermaLink="false">http://mikeconley.ca/blog/?p=387</guid>
		<description><![CDATA[Wow.  I think I got it.  I&#8217;ve got a Firefox plugin that can suppress all alert() dialogs on a page if the user checks a &#8220;suppress&#8221; box on the second alert() dialog. The trick, was not to rely on the DOMContentLoaded event to fire to do the override.  Instead, I used the DOMWillOpenModalDialog to detect [...]]]></description>
			<content:encoded><![CDATA[<p>Wow.  I think I got it.  I&#8217;ve got a Firefox plugin that can suppress all alert() dialogs on a page if the user checks a &#8220;suppress&#8221; box on the second alert() dialog.</p>
<p>The trick, was not to rely on the DOMContentLoaded event to fire to do the override.  Instead, I used the DOMWillOpenModalDialog to detect the first alert().  After detection, I overrode with an alertCheck which asked the user whether or not to &#8220;suppress more dialogs&#8221;.  If the user answers in the affirmative, alert() is simply overwritten with an empty function.</p>
<p>Piece of cake.</p>
<p>A couple of issues though&#8230;</p>
<h2>Security</h2>
<p>In order to override the alert() function, I have to write to document.getElementById(&#8216;content&#8217;).contentWindow.wrappedJSObject.alert.</p>
<p>Remember how I mentioned the <em>distance</em> between the Extension JavaScript, and the inline content JavaScript?  I said it felt like a security layer.</p>
<p>I was totally right.</p>
<p><a href="https://developer.mozilla.org/En/Working_with_windows_in_chrome_code#Accessing_content_documents">Check this out.</a> I&#8217;ll quote:</p>
<blockquote><p>You should be aware of <a rel="internal" href="https://developer.mozilla.org/en/XPCNativeWrapper">XPCNativeWrappers</a> when working with <a rel="internal" href="https://developer.mozilla.org/en/XPCNativeWrapper#What_is_a_trusted_window.3F">untrusted content</a>. With XPCNativeWrappers turned on (which is the default in Firefox 1.5+), your extension can safely access the DOM of the content document, but not the content JavaScript. Bypassing XPCNativeWrapper to work with content JavaScript directly can lead to security problems.</p></blockquote>
<p>Hrmph.  So I seem to be violating some security rules here.  So maybe my approach isn&#8217;t the greatest idea.  &#8220;Mook&#8221; from irc.mozilla.net #extdev suggested looking into commonDialog.xul&#8230;but I can&#8217;t seem to wrap my head around that just yet.</p>
<h2>Imperfections</h2>
<p>Not sure why yet, but while I can suppress dialog floods like this:</p>
<pre>for (i = 0; i &lt; 10; ++i) {
  alert(i);
}</pre>
<p>It seems to fail on this:</p>
<pre>for (i = 0; i &lt; 10; ++i) {
  alert(i);
  confirm(i);
}</pre>
<p>For some reason, regardless of whether or not I choose to suppress the dialogs, they just keep coming.  It works fine when I swap out the confirm() for a second alert().  Not exactly sure why.  Yet.</p>
<p>Ok, so I&#8217;m going to clean the code up, and post it soon.  I&#8217;ll also post a link to a real, brutally annoying website where you can test the alertCheck extension.  Just give me a bit.</p>
]]></content:encoded>
			<wfw:commentRss>http://mikeconley.ca/blog/2009/05/03/overriding-firefox%e2%80%99s-windowalert-part-3/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Overriding Firefox’s Window.Alert &#8211; Part 2</title>
		<link>http://mikeconley.ca/blog/2009/05/02/overriding-firefox%e2%80%99s-windowalert-part-2/</link>
		<comments>http://mikeconley.ca/blog/2009/05/02/overriding-firefox%e2%80%99s-windowalert-part-2/#comments</comments>
		<pubDate>Sat, 02 May 2009 23:19:04 +0000</pubDate>
		<dc:creator>Mike</dc:creator>
				<category><![CDATA[Computer Science]]></category>
		<category><![CDATA[Firefox Extensions]]></category>
		<category><![CDATA[Internet]]></category>
		<category><![CDATA[Javascript]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Technology]]></category>
		<category><![CDATA[alertCheck]]></category>
		<category><![CDATA[alert]]></category>
		<category><![CDATA[commonDialog.xul]]></category>
		<category><![CDATA[content.alert]]></category>
		<category><![CDATA[DoS]]></category>
		<category><![CDATA[extension]]></category>
		<category><![CDATA[firefox]]></category>
		<category><![CDATA[mozilla]]></category>
		<category><![CDATA[window.alert]]></category>

		<guid isPermaLink="false">http://mikeconley.ca/blog/?p=381</guid>
		<description><![CDATA[Ok, so there have been some developments. Before I go into this though, I just want to make it clear that I have very little knowledge or experience working with XUL, or writing Firefox extensions in general.  I&#8217;ve dabbled, but I&#8217;m mostly ignorant.  So all you Firefox aficionados out there&#8230;go easy on me. So, developments: [...]]]></description>
			<content:encoded><![CDATA[<p>Ok, so there have been some developments.</p>
<p>Before I go into this though, I just want to make it clear that I have <em>very little </em>knowledge or experience working with XUL, or writing Firefox extensions in general.  I&#8217;ve dabbled, but I&#8217;m mostly ignorant.  So all you Firefox aficionados out there&#8230;go easy on me.</p>
<p>So, developments:</p>
<p>Using <a href="http://ted.mielczarek.org/code/mozilla/extensionwiz/">this site</a>, I created a skeleton for my extension, calling it &#8220;alertCheck&#8221;.</p>
<p>And then I hit a brick wall right away, trying to find the right &#8220;alert&#8221; to override.</p>
<p>Let me explain.  Mozilla extension development is strange for me because of all of the various layers to Firefox, and the <em>distance</em> between the JavaScript in the extension, and any page that is loaded in the browser.  It feels like a security layer &#8211; and it makes sense:  you <em>really</em> don&#8217;t want the Javascript on a website to monkey around with the internals of your browser.</p>
<p>Thankfully, <a href="http://forums.mozillazine.org/viewtopic.php?f=19&amp;t=326355&amp;p=1791443">this forum</a> and <a href="http://markmail.org/message/gsxdzrhddztbgtbc">this forum</a> provided some help.</p>
<p>Now, after the appcontent is loaded, I wait for the DOMContentLoaded event to fire, and then write my new alert function to here:</p>
<pre>document.getElementById('content').contentWindow.wrappedJSObject.alert</pre>
<p>The problem is, if I wait for the DOMContentLoaded event to fire, the alert override happens (obviously) <em>after </em>all of the DOM Content is loaded into the browser.  This is only useful if the alert&#8217;s that we want to capture are fired using &lt;body onLoad&gt; or some other function that detects when the DOM has been loaded.  It&#8217;s no good for inline Javascript alerts, since these commands are parsed and executed line by line as the HTML is processed.</p>
<p>Phew.  Big mouthful.</p>
<p>So, where does that leave me?  Well, I was just hanging out in irc.mozilla.net in the #extdev channel.  Here&#8217;s a chunk of what was said:</p>
<pre>&lt;mike_conley&gt; Hey all - I'm trying to write an extension to override window.alert, with an alertCheck that allows users to disable future alerts.
&lt;mike_conley&gt; So far, I'm able to override alert by writing to document.getElementById('content').contentWindow.wrappedJSObject.alert
&lt;mike_conley&gt; however, now it's a matter of timing - I'm doing the override after the DOMContentLoaded event is fired
&lt;mike_conley&gt; But this means that it doesn't catch alerts that are fired using inline javascript.
&lt;mike_conley&gt; So my question is, when should I do the override?
&lt;Mook&gt; I suspect just overriding commonDialog.xul is easier
&lt;Mook&gt; trying to poke the content JS's definition is going to be full of pain
&lt;mike_conley&gt; Cool, I'll look into that - thanks!
&lt;Mook&gt; (the content JS starts around http://mxr.mozilla.org/mozilla/source/dom/src/base/nsGlobalWindow.cpp#4022 and goes the the prompt service which pokes that xul)
&lt;mike_conley&gt; Excellent - I appreciate it.</pre>
<p>So maybe there&#8217;s another approach that I should be taking &#8211; I&#8217;m going to look into overriding commonDialog.xul&#8230; I&#8217;ll write more when I have it.</p>
]]></content:encoded>
			<wfw:commentRss>http://mikeconley.ca/blog/2009/05/02/overriding-firefox%e2%80%99s-windowalert-part-2/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
