7 ms·
Execute any JavaScript from any browser tab on any browser tabs
- ultrasaurus 3y agoSeems like a very narrow segment of people who: - want to run custom JS from one tab in another often - Wouldn't write their own extension to do it But credit for OSSing your own tools :)
- austin-cheney 3y agoNo I could use something like this to screen scrape from any site with far lower effort.
- hulitu 3y agoIsn't this what extensions do ? (i.e. uBlock origin)
- user_7832 3y agoI'm not able to understand, what might be the utility of doing so?
- pcthrowaway 3y agoOh I don't know, I could see it being useful it it's possible to hook up with rtk-query or react-query, to prevent duplicate requests from multiple instances of an app that might be running. Though I guess this might just trigger all the requests on all that tabs anyway. I suppose you'd have to add architecture to start one instance of that app as the 'controller' and then a way to pass off controller responsibilities to other tabs... which sounds like basically "step 2: draw the rest of the owl" Since I just noticed this is an extension rather than a library, I think it's probably more useful for automating interactions with a number of tabs of the same page (but puppeteer or something similar would probably be a better fit for this also)
- solardev 3y agoFor cross-tab communications, there are better APIs, like https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_Channel_API https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_C... For user-driven automations, something like Tampermonkey would be way better (and safer, since they can be domain-limited). I can think of no reason why a regular user would want to allow tabs to execute each other's code... that just seems like a setup for self-XSS attacks by people who don't know any better :( --------- edit: Sorry, re: the second part of your comment, I misunderstood what you meant. Like if you wanted to purposely script multiple identical tabs at the same time.
- 000ooo000 3y agoI once had to debug a sporadic problem in a prod system I wasn't familar with, which seemed to be caused by two requests made simultaneously by different users. I could have assembled curl commands but the easiest thing to reproduce and verify the issue was to run a setTimeout(clickSubmit, 5s) in both browser session's consoles. Weirdly niche use case, but something like this extension would've been useful.
- megous 3y agoYou can also copy curl command right from the browser network tab, to recreate the request.
- extraduder_ire 3y agoI don't know of a reliable way of calling two separate curl commands at once though. Maybe abusing the shell job system, or learning the 'at' command. It has been a while since I've needed to do something like this.
- bdcravens 3y agoCould be an alternative to Puppeteer/Playwright for automating a browser.
- andrewstuart 3y agoI don't get it. is this surprising or unusual or a security issue?
- Goofy_Coyote 3y agoIt's not a security issue. This is an extension, it's weird and has some niche use-cases, but it is not a security issue as far as I can tell. It's not like "include a script in a page, then execute arbitrary js on any tabs of anyone who visits that page". That would've been a CVSS 10.
- pcthrowaway 3y agoIt kind of is, it injects the `tabgod` function into the window object of every tab. I could put something like this in the script for my blog: if (typeof window.tabgod === 'function') { tabgod( (tab) => tab.url === 'https://bankofamerica.com', () => { /* absolutely nothing good */ }, } } Keep in mind any network requests running from the script directly in the page will happily send your cookies, so this makes it trivial to gain unauthorized access to people's accounts. Any site you visit while running this extension can basically access your private data from every other site you happen to have a tab open for, and send requests impersonating you. It could also install a keyboard logger, etc.
- ambigious7777 3y agoI know pretty much nothing about web extensions, but isn't it possible to add custom DevTools functions, like getEventListeners() or copy() in Chrome, without the page being accessed?
- bryanrasmussen 3y agoAlso if for example somebody has written a window opener function in their site's code and made the mistake of naming it tabgod there might also be problems. But from reading the description it says in all devtools consoles - so I had assumed it was only in devtools context that the function was available?
- deleted 3y ago[deleted]
- extraduder_ire 3y agoI'm surprised how short the source code for this is. I guess it doesn't have to do that much.
- danielvaughn 3y agoI haven’t read the source code but I assume it’s just a wrapper about BroadcastChannel.
- devidw 3y agoIt's a combination of chrome.runtime messaging api to establish a connection between the calling tab and the service worker and chrome.scripting api to actually execute on the target tabs. Tho you can only send json and not functions over the port so functions have to be stringified and the eval() on the tab main world. Since eval is not possible in extensions itself for good reason the only way is to do this on the tabs, so the tab filtering will also be done in a tab world and will respond the filtered tab ids back to the service worker.
- test6554 3y agoBrowser makers: creates carefully thought out security features Junior Developers: what’s this do? Probably nothing… yeet
- r-spaghetti 3y agoany browser tabs as in only chrome browser tabs?
- devidw 3y agoonly chrome/chromium tabs right now
- smusamashah 3y agoThis seems very useful running a local first app in one of the tabs. Then using this, you can send requests to that app from anywhere and get your responses back where you requested from.
- bryanrasmussen 3y agoIt looks like it might be any Chrome browser tab and not "any browser tab" however since Firefox supports Broadcast channel API it should probably be theoretically possible in there.
- devidw 3y agoyea chrome only right now & yep would prob just have to replace the api signatures where "chrome" is used to port it over
- hulitu 3y ago> Execute any JavaScript from any browser tab on any browser tabs Isn't this what a Browser does ?