views:

121

answers:

1

My problem is -- I have a html file which is really JS program, which reads web pages and show them in customized manner (i.e. it displays the same content in a different way).

Basically, I create XMLHttpRequest object and then

  req.open("GET", web_page_address, false);
  req.send("");

This gives me (in firefox) an error:

Error: uncaught exception: [Exception... "Access to restricted URI denied" code: "1012" nsresult: "0x805303f4 (NS_ERROR_DOM_BAD_URI)"

I already googled, and looked at SO but all other issues are very similar with those two exceptions:

  • the file I open in firefox is a local file, opened directly in browser -- I don't have www server running at localhost

  • I don't have any control over the web pages I am reading stuff from

So, several solutions I've seen so far (like adding PHP proxy, changing the way external server sends data) cannot be applied here.

What else can be done in such case? Another story is I am wondering if such strict security for directly local file has any sense.

Thank you in advance for tips/links/etc.

Have a nice day!

edit: Any straightforward way won't work because Firefox does this on purpose:
https://bugzilla.mozilla.org/show_bug.cgi?id=560488

+1  A: 

I don't think you can do anything with that setup.

Anyway, despair not! As this looks to me anyway like something with a controlled user base, you can do the same with a Firefox extension. Extensions have chrome privileges and you can get any page from any domain you want.

If you only want to modify some pages, you can also look into Greasemonkey, and start writing some javascript to modify a web page without bothering to learn how to make an extension. (Not that extensions are difficult!)

Victor
Thank you very much for the answer. However I cannot do mybrowser-only solution. This html file should work in any browser -- it is supposed to be distributed as a program (requirement: www browser, any). Btw. the file works in Konqueror without any modification.
macias
Sub-question -- how would you set up a phishing attack with local JS? I think it would be easier to just embed everything what you (attacker) need in this file instead of fetching it using JS.
macias
Hmmm, maybe ajax requests are not that dangerous, I was thinking more in the line of cross-frame manipulation.
Victor
Sorry, I have no idea what this policy protects...
Victor