[RESOLVED] EXTREMELY SIMPLE surrogate script not working

[TooCrooked]

im running FF 3.6.3 and NS 1.9.9.74

im simply trying to create a surrogate script that will essentially overwrite function "test" after the page loads:

Code: Select all

user_pref("noscript.surrogate.test.replacement", "window.test=function(){alert('changed')}");
user_pref("noscript.surrogate.test.sources", "^file://*");

the file on my desktop has this in it:

Code: Select all

<script>
function test() { alert("original") }
</script>
<button onclick=test()>test</button>


the expected outcome is that once i click the button, i'll see an alert that says "changed". this doesnt happen; it says "original".

this should work because my javascript logic is correct:

Code: Select all

<script>
function test() { alert("original") }
window.test = function() {alert('changed')} // what the surrogate should pretty much be doing
</script>
<button onclick=test()>test</button>
<!-- alerts "changed" -->

after some testing, i found something more troubling; this EVEN SIMPLER syntax does NOT WORK:

Code: Select all

user_pref("noscript.surrogate.test.replacement", "alert('test')");
user_pref("noscript.surrogate.test.sources", "^file://*");

what am i missing?????? note, i do not want to run my surrogate BEFORE the page loads via the use of the "@" sign as noted here

[al_9x]

According to the explanation that you linked to,

How does it work? Very simple: whenever an external script is blocked, NoScript checks if its URL matches a certain pattern, and if it does an alternate user-provided surrogate script gets executed instead, in the context of the loading page.

regular surrogate sources are matched only against blocked external scripts. It looks like you want to match the page itself and so need a page level surrogate (@). Though it runs before the page scripts are executed, you can defer your replacement by putting it in the load event handler.

Code: Select all

addEventListener('load',function(){...},true);


[TooCrooked]

thanks for clearing that up. lots of win on this forum.

[dhouwn]

Code: Select all

v 1.9.9.79
==========================================================================
x Script surrogates whose source starts with the '!' get executed on
  pages where scripts are disabled (on document DOM completion, rather
  than before HTML parsing starts like regular surrogates)

[Giorgio Maone]

Just to recap, now we got 3 types of surrogates:

1. "Inclusion" surrogates, which run in place of the external scripts which are blocked and whose URL matches the "sources" preference.
2. "Page" surrogates (@), whose "sources" preference, matching the page's URL itself instead of a script source, is prefixed with an "@" character and which run before HTML parsing starts (i.e. you don't have any DOM node yet). This is useful to replace standard JavaScript/DOM objects before they get used by inlined scripts. If you need to run after the DOM is completed, you can attach a "DOMContentLoaded" listener (or a "load" listener if you need every subrequest, e.g. for images or frames, to have been completed as well).
3. "Fallback" surrogates (!). Like the "Page" surrogates their "source" preference matches the page's URL, but
   
   • their "source" preference is prefixed with an "!" character
   • they run only if JavaScript is disabled for this page
   • they run on DOM completion (i.e. in a "DOMContentLoaded" listener) by default, as a convenience since in a script-disabled page the only useful things you can do are manipulating DOM nodes and attaching UI events
   This kind of surrogates are very similar to GreaseMonkey scripts, both because of the "late" time they run at and because they're ran in a sandbox (with the content window seen as the global object, though), rather than in the page's context.

So types 1 & 2 run when the page can run scripts, type 3 when page can't.

What the OP was trying to do can be accomplished in two ways, both using type 2 (Page, @) surrogates:

1. This one replaces the function as soon as the DOM loads (more or less as suggested by al_9x).
   

   Code: Select all

   user_pref("noscript.surrogate.test.replacement", "addEventListener('DOMContentLoaded', function(ev) { window.test=function(){alert('changed')}, true)");
user_pref("noscript.surrogate.test.sources", "@^file:");


2. This one creates the function before HTML parsing start, makes the getter for the "test" window property return it and defines an empty getter to smoothly prevent "test" from being rewritten. Albeit a bit more complex, it has the advantage that the replacement function will be called also by early inline scripts.
   

   Code: Select all

   user_pref("noscript.surrogate.test.replacement", "__defineGetter__('test', function(){return function(){alert('changed')}});__defineSetter__('test', function(){});");
user_pref("noscript.surrogate.test.sources", "@^file:");


[TooCrooked]

are "inclusion" surrogates those that do not have a "!" or a "@" as a prefix? therefore, in my original post, the reason why my alert("test") didn't fire is because file:// was allowed to run scripts?

[Giorgio Maone]

are "inclusion" surrogates those that do not have a "!" or a "@" as a prefix?

Yes, they're the "simple" ones whose "sources" preference has no prefix.

therefore, in my original post, the reason why my alert("test") didn't fire is because file:// was allowed to run scripts?

No, it's because your page did not contain any <script src="file://something"></script> element.
"Inclusion" surrogates replace <script src="xyz"></script> imported scripts with matching URLs.