Page 1 of 1

[Resolved] Why this NS surrogate hose WebExt context menu?

Posted: Wed Aug 01, 2018 12:55 am
by barbaz
I use a NoScript surrogate to disable context menu hijacking by default while allowing it on specific sites -


Code: Select all


Code: Select all

Unfortunately I just discovered this surrogate causes WebExtensions' context menu items registered by chrome.contextMenus API to do nothing. WebExtensions that rely on context menu, such as ... text-link/, end up completely hosed.

I thought WebExtensions were supposed to be more privileged than web content. And NoScript surrogates don't apply to privileged content.

So why would this surrogate even interfere with WebExtensions APIs?
Is there another way to write the surrogate that still works just as effectively but doesn't kill WebExtensions?

(Browser is Waterfox 56.2.2, NoScript version is

Re: Why this NS surrogate hose WebExtension context menu?

Posted: Tue Aug 07, 2018 4:07 pm
by barbaz
Ok it's not a general WebExtension issue, but a weird side-effect of how the specific WebExtensions I'm using are implemented (Copy Text Link and Remove Anything). They use

Code: Select all

document.addEventListener("contextmenu", ...)
and it is this code the surrogate hoses.

This is not a NoScript issue either. A webpage including the same JS as the surrogate breaks these WebExtensions the same way.

So the issue here looks like some sort of lack of proper isolation between webpage-added event listeners and contentscript-added event listeners.

Interestingly, about:config > dom.event.contextmenu.enabled;false does *not* break these WebExtensions. But that's not a solution for me because I need context menu events enabled for a few sites. And it doesn't block a webpage that includes the surrogate's JS from hosing these WebExtensions.

Firefox 61.0.1 is likewise affected.

Not sure what to do at this point Image

Re: Why this NS surrogate hose WebExtension context menu?

Posted: Tue Aug 07, 2018 6:41 pm
by barbaz
Looks like dom.event.contextmenu.enabled doesn't enable/disable the entire contextmenu event. It only controls whether preventDefault can be used on contextmenu events. The NoScript surrogate I came up with maybe unnecessarily sledgehammer.

How to make a surrogate that emulates dom.event.contextmenu.enabled?

Re: Why this NS surrogate hose WebExtension context menu?

Posted: Fri Sep 07, 2018 1:47 am
by barbaz
I tried a surrogate based on -

Code: Select all

let p=Event.prototype.preventDefault;Event.prototype.preventDefault=function(){if('contextmenu'==this.type)return;;};
But it fails on e.g. this HTML page -

Code: Select all

<!doctype html>
<div id="1">Right click Here for No Context Menu</div>
document.getElementById('1').oncontextmenu=function(ev){return false};
I'm now unsure whether surrogate can do what I'm looking for here.

Re: Why this NS surrogate hose WebExtension context menu?

Posted: Sat Sep 08, 2018 7:53 pm
by barbaz
Although likely not a perfect solution, it turns out surrogate can resolve this well enough. I have managed to prevent context menu hijacking while keeping my WebExtensions context menu items working, at the cost of undesirable breaking of some webpage functionality.