sandbox escape with unsafeWindow

[luomoxu]

I try this userscript in ChromeXt(v3.8.2) and tampermonkey on PC

// ==UserScript==
// @name         debug
// @namespace    debug
// @version      0.0.1
// @description  debug
// @author       debug
// @match        https://*/*
// @require      https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.slim.min.js
// @grant        unsafeWindow
// ==/UserScript==
unsafeWindow.debug="unsafeWindow";
window.debug="window";
console.log("debug", debug);
console.log("window.debug", window.debug);
console.log("unsafeWindow.debug", unsafeWindow.debug);

console.log("$.fn.jquery", $.fn.jquery);
console.log("window.$.fn.jquery", window.$.fn.jquery);
console.log("unsafeWindow.$.fn.jquery", unsafeWindow.$.fn.jquery);

ChromeXt result

debug unsafeWindow
window.debug window
unsafeWindow.debug unsafeWindow
$.fn.jquery 3.7.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/animatedSelector,-effects/Tween
window.$.fn.jquery 3.7.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/animatedSelector,-effects/Tween
unsafeWindow.$.fn.jquery 3.7.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/animatedSelector,-effects/Tween

tampermonkey

debug window
window.debug window
unsafeWindow.debug unsafeWindow
$.fn.jquery 3.7.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/animatedSelector,-effects/Tween
window.$.fn.jquery 3.7.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-deprecated/ajax-event-alias,-effects,-effects/animatedSelector,-effects/Tween
unsafeWindow.$.fn.jquery 1.12.4

[JingMatrix]

Do you have any opinion on the differences? When unsafeWindow is granted, modifying unsafeWindow will modfiy global varaibles, that is the intended behavior.

[luomoxu]

In my understanding, user scripts should run in their own sandbox and can access data outside the sandbox through unsafeWindow
But from my test results, ChromeXt is in a very strange state
The following script can help understand this result

Script with nothing

// ==UserScript==
// @name         debug
// @namespace    debug
// @version      0.0.1
// @description  debug
// @author       debug
// @match        https://*/*
// @match        http://*/*
// @require      https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.slim.min.js
// ==/UserScript==
window.debug="window";
console.log("window.debug", window.debug);
console.log("typeof(debug)", typeof(debug));

console.log("$.fn.jquery", $.fn.jquery);
console.log("window.$.fn.jquery", window.$.fn.jquery);

ChromeXt

UserScript output

window.debug window
typeof(debug) undefined
$.fn.jquery 3.7.1
window.$.fn.jquery 3.7.1

DevTool Console

$.fn.jquery 3.7.1

tampermonkey

UserScript output

window.debug window
typeof(debug) string
$.fn.jquery 3.7.1 
window.$.fn.jquery 3.7.1

DevTool Console

$.fn.jquery 3.7.1

Script with none

// ==UserScript==
// @name         debug
// @namespace    debug
// @version      0.0.1
// @description  debug
// @author       debug
// @match        https://*/*
// @match        http://*/*
// @require      https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.slim.min.js
// @grant        none
// ==/UserScript==
window.debug="window";
console.log("window.debug", window.debug);
console.log("typeof(debug)", typeof(debug));

console.log("$.fn.jquery", $.fn.jquery);
console.log("window.$.fn.jquery", window.$.fn.jquery);

ChromeXt

UserScript output

window.debug window
typeof(debug) string
$.fn.jquery 3.7.1
window.$.fn.jquery 3.7.1

DevTool Console

$.fn.jquery 3.7.1

tampermonkey

UserScript output

window.debug window
typeof(debug) string
$.fn.jquery 3.7.1 
window.$.fn.jquery 3.7.1

DevTool Console

$.fn.jquery 3.7.1

[JingMatrix]

ChromeXt doesn't seek to behave the same as TamperMonkey, I implemented its APIs from the API specification, not from the runtime result of TamperMonkey.

If ChromeXt doesn't behave as what the API specification says, you may point it out. Otherwise, these differences due to different implements can be ignored. TamperMonkey is not the standard, the API doc is.

[luomoxu]

I only found tTampermonkey API link on the homepage
I'm not sure yet if ChromeXt has a sandbox?

[JingMatrix]

When I designed it, I referred to different API standards, including the one of ViolentMonkey.
The sandbox of ChromeXt is artificial, meant to provide maximal compatibility of existing scripts.

To know what happens, you may to use the debugger to execute step by step.

[luomoxu]

ViolentMonkey result is same as TamperMonkey
If require jquery in userscript,the original jquery will force overlay forever

[JingMatrix]

Please show me the example of so-called overlay forever. I didn't understand well what you meant here.

[luomoxu]

Test on https://www.jetbrains.com/ ,webpage default Jquery version 3.7.1

UserScript 1 with @grant none

// ==UserScript==
// @name         debug
// @namespace    debug
// @version      0.0.1
// @description  debug
// @author       debug
// @match        *://*/*
// @require      https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
// @grant        none
// ==/UserScript==
console.log("userscript",$.fn.jquery);

ChromeXt

• UserScript output

userscript 2.2.4

• DevTools Console

console.log("Devtools",$.fn.jquery);
Devtools 2.2.4

Violentmonkey

• UserScript output

userscript 2.2.4

• DevTools Console

console.log("Devtools",$.fn.jquery);
Devtools 2.2.4

UserScript 2 with @grant unsafeWindow

// ==UserScript==
// @name         debug
// @namespace    debug
// @version      0.0.1
// @description  debug
// @author       debug
// @match        *://*/*
// @require      https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
// @grant        unsafeWindow
// ==/UserScript==
console.log("userscript",$.fn.jquery);

ChromeXt

• UserScript output

userscript 2.2.4

• DevTools Console

console.log("Devtools",$.fn.jquery);
Devtools 2.2.4

Violentmonkey

• UserScript output

userscript 2.2.4

• DevTools Console

console.log("Devtools",$.fn.jquery);
Devtools 3.7.1

[luomoxu]

https://wiki.greasespot.net/Security
https://groups.google.com/g/greasemonkey-users/c/mow6fpWmIvE
If you don't care about safety issues, just pretend I didn't say anything.

[JingMatrix]

Then you should remove @grant none or @grant unsafeWindow, which will give you the sandbox as intended.

[luomoxu]

// ==UserScript==
// @name         debug
// @namespace    debug
// @version      0.0.1
// @description  debug
// @author       debug
// @match        *://*/*
// @require      https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
// ==/UserScript==
console.log("userscript",$.fn.jquery);

ChromeXt

• UserScript output

userscript 2.2.4

• DevTools Console

console.log("Devtools",$.fn.jquery);
Devtools 2.2.4

The sandbox does not take effect

[JingMatrix]

Okay, I see what you meant. It seems that jquery tried hard to get out of any sandbox.

[JingMatrix]

It might have done this:

ChromeXt/app/src/main/assets/GM.js

Line 10 in 7b53bb7

// However, one can break this jail using setTimeout or Function.

[luomoxu]

Are there any plans to address this issue?

[JingMatrix]

I will have a look later, maybe a workaround is needed

[JingMatrix]

This is actually the intended behavior, I added it in a9af491

[JingMatrix]

I think it is better to implement the @sandbox api to control the behavior of imported scripts by UserScripts.

[JingMatrix]

The problem is already fixed, you can add

@sandbox DOM

to avoid the overwriting issue.

[luomoxu]

Thank you so much