view release on metacpan or  search on metacpan

lib/WWW/Mechanize/Firefox.pm  view on Meta::CPAN

structures like objects. When working with results from
untrusted sources, you can only safely use simple
types like C<string>.

If you want to modify the environment the code is run under,
pass in a hash reference as the second parameter. All keys
will be inserted into the C<this> object as well as
C<this.window>. Also, complex data structures are only
supported if they contain no objects.
If you need finer control, you'll have to
write the Javascript yourself.

This method is special to WWW::Mechanize::Firefox.

Also, using this method opens a potential B<security risk> as
the returned values can be objects and using these objects
can execute malicious code in the context of the Firefox application.

=cut

sub eval_in_page {
    my ($self,$str,$env,$doc,$window) = @_;
    $env ||= {};
    my $js_env = {};
    $doc ||= $self->document;

    # do a manual transfer of keys, to circumvent our stupid
    # transformation routine:
    if (keys %$env) {
        $js_env = $self->repl->declare(<<'JS')->();
            function () { return new Object }
JS
        for my $k (keys %$env) {
            $js_env->{$k} = $env->{$k};
        };
    };

    my $eval_in_sandbox = $self->repl->declare(<<'JS', 'list');
    function (w,d,str,env,caller,line) {
        var unsafeWin = w.wrappedJSObject;
        var safeWin = XPCNativeWrapper(unsafeWin);
        var sandbox = Components.utils.Sandbox(safeWin);
        sandbox.window = safeWin;
        sandbox.document = d;
        // Transfer the environment
        for (var e in env) {
            sandbox[e] = env[e]
            sandbox.window[e] = env[e]
        }
        sandbox.__proto__ = unsafeWin;

        var res = Components.utils.evalInSandbox(str, sandbox, "1.8",caller,line);
        return [res,typeof(res)];
    };
JS
    $window ||= $self->tab->{linkedBrowser}->{contentWindow};
    # Report errors from scope of caller
    # This feels weirdly backwards here, but oh well:
    #local @CARP_NOT = (ref $self->repl); # we trust this

    my ($caller,$line) = (caller)[1,2];

    $eval_in_sandbox->($window,$doc,$str,$js_env,$caller,$line);
};
*eval = \&eval_in_page;

=head2 C<< $mech->unsafe_page_property_access( ELEMENT ) >>

Allows you unsafe access to properties of the current page. Using
such properties is an incredibly bad idea.

This is why the function C<die>s. If you really want to use
this function, edit the source code.

=cut

sub unsafe_page_property_access {
    my ($mech,$element) = @_;
    die;
    my $window = $mech->tab->{linkedBrowser}->{contentWindow};
    my $unsafe = $window->{wrappedJSObject};
    $unsafe->{$element}
};

=head1 UI METHODS

See also L<Firefox::Application> for how to add more than one tab
and how to manipulate windows and tabs.

=head2 C<< $mech->application() >>

    my $ff = $mech->application();

Returns the L<Firefox::Application> object for manipulating
more parts of the Firefox UI and application.

=cut

sub application { $_[0]->{app} };

=head2 C<< $mech->autoclose_tab >>

  $mech->autoclose_tab( 0 ); # keep tab open after program end

Set whether to close the tab associated with the instance.

=cut

sub autoclose_tab {
    my $self = shift;
    $self->application->autoclose_tab($self->tab, @_);
};

=head2 C<< $mech->tab() >>

Gets the object that represents the Firefox tab used by WWW::Mechanize::Firefox.

This method is special to WWW::Mechanize::Firefox.

=cut