Execute any JavaScript from any browser tab on any browser tabs | Hacker News Reader

Execute any JavaScript from any browser tab on any browser tabs

github.com

46 pointsdevidw32 comments

Open articleView on HN

Seems like a very narrow segment of people who:

- want to run custom JS from one tab in another often

- Wouldn't write their own extension to do it

But credit for OSSing your own tools :)

No I could use something like this to screen scrape from any site with far lower effort.

Isn't this what extensions do ? (i.e. uBlock origin)

I don't get it. is this surprising or unusual or a security issue?

It's not a security issue. This is an extension, it's weird and has some niche use-cases, but it is not a security issue as far as I can tell.

It's not like "include a script in a page, then execute arbitrary js on any tabs of anyone who visits that page".

That would've been a CVSS 10.

It kind of is, it injects the `tabgod` function into the window object of every tab. I could put something like this in the script for my blog:

    if (typeof window.tabgod === 'function') {
        tabgod(
            (tab) => tab.url === 'https://bankofamerica.com',
            () => { /* absolutely nothing good */ },
        }
    }

Keep in mind any network requests running from the script directly in the page will happily send your cookies, so this makes it trivial to gain unauthorized access to people's accounts. Any site you visit while running this extension can basically access your private data from every other site you happen to have a tab open for, and send requests impersonating you. It could also install a keyboard logger, etc.

yea your right, i have addressed this by moving the api from the window object to a dev tools panel page & options page of the extension so the website itself is no longer able to communicate to the service worker of the extension that is opening up the bridge to access all tabs

https://github.com/devidw/tabgod/issues/1#issuecomment-19336...

Also if for example somebody has written a window opener function in their site's code and made the mistake of naming it tabgod there might also be problems.

But from reading the description it says in all devtools consoles - so I had assumed it was only in devtools context that the function was available?

Good point. Though this needs the target to have the extension installed.

I was thinking more along the lines of breaking out of process/site isolation or sandboxing - but yeah, you're making a good point.

I know pretty much nothing about web extensions, but isn't it possible to add custom DevTools functions, like getEventListeners() or copy() in Chrome, without the page being accessed?

> Execute any JavaScript from any browser tab on any browser tabs

Isn't this what a Browser does ?

nah, the idea is to make it easy to execute javascript across multiple tabs

Yes, but for this, you need a XSS vulnerability. /s

or a browser extension :)

This seems very useful running a local first app in one of the tabs. Then using this, you can send requests to that app from anywhere and get your responses back where you requested from.

I'm not able to understand, what might be the utility of doing so?

I once had to debug a sporadic problem in a prod system I wasn't familar with, which seemed to be caused by two requests made simultaneously by different users. I could have assembled curl commands but the easiest thing to reproduce and verify the issue was to run a setTimeout(clickSubmit, 5s) in both browser session's consoles. Weirdly niche use case, but something like this extension would've been useful.

You can also copy curl command right from the browser network tab, to recreate the request.

I don't know of a reliable way of calling two separate curl commands at once though. Maybe abusing the shell job system, or learning the 'at' command. It has been a while since I've needed to do something like this.

Why abuse? That's what it's for. I'd just copy paste the curl line into a script file several times and put & at the end of each line.

Then end the script with wait command and run the script.

if curl & curl is too slow, try using gnu/parallel.

Oh I don't know, I could see it being useful it it's possible to hook up with rtk-query or react-query, to prevent duplicate requests from multiple instances of an app that might be running.

Though I guess this might just trigger all the requests on all that tabs anyway. I suppose you'd have to add architecture to start one instance of that app as the 'controller' and then a way to pass off controller responsibilities to other tabs... which sounds like basically "step 2: draw the rest of the owl"

Since I just noticed this is an extension rather than a library, I think it's probably more useful for automating interactions with a number of tabs of the same page (but puppeteer or something similar would probably be a better fit for this also)

For cross-tab communications, there are better APIs, like https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_C...

For user-driven automations, something like Tampermonkey would be way better (and safer, since they can be domain-limited).

I can think of no reason why a regular user would want to allow tabs to execute each other's code... that just seems like a setup for self-XSS attacks by people who don't know any better :(

---------

edit: Sorry, re: the second part of your comment, I misunderstood what you meant. Like if you wanted to purposely script multiple identical tabs at the same time.

Could be an alternative to Puppeteer/Playwright for automating a browser.

It looks like it might be any Chrome browser tab and not "any browser tab"

however since Firefox supports Broadcast channel API it should probably be theoretically possible in there.

yea chrome only right now & yep would prob just have to replace the api signatures where "chrome" is used to port it over

any browser tabs as in only chrome browser tabs?

only chrome/chromium tabs right now

I'm surprised how short the source code for this is. I guess it doesn't have to do that much.

Browser makers: creates carefully thought out security features

Junior Developers: what’s this do? Probably nothing… yeet

I haven’t read the source code but I assume it’s just a wrapper about BroadcastChannel.

It's a combination of chrome.runtime messaging api to establish a connection between the calling tab and the service worker and chrome.scripting api to actually execute on the target tabs. Tho you can only send json and not functions over the port so functions have to be stringified and the eval() on the tab main world. Since eval is not possible in extensions itself for good reason the only way is to do this on the tabs, so the tab filtering will also be done in a tab world and will respond the filtered tab ids back to the service worker.

Reply on news.ycombinator.com