setTimeout not working in Greasemonkey user script when JS disabled in browser

Question

I'm working on a project that requires my user script be run on pages as they are rendered without executing any of the page's JavaScript. That is to say, we need to browse with JavaScript disabled.

I've encountered a problem though when I try to delay execution of a function within my script. Whenever I make a call to window.setTimeout, the function I pass in never gets executed.

I think maybe this function is actually getting called on unsafeWindow instead of window. Is there any workaround for this?

I should mention that calls to setTimeout work fine when JavaScript is enabled and everything else in my script is working fine without enabling JavaScript.

Thanks for your help!

Answer 1

The window reference is still the page's window, just wrapped in the sandbox wrapper thing. When you call setTimeout on it you're still setting up something to be run by the page. I suppose that it must be the case that the browser won't fire those timeout events at all (or will just ignore the events) when Javascript is disabled.

Answer 2

Even though Greasemonkey JavaScript runs with elevated privileges, as Pointy said, setTimeout functions are appended to the page's JavaScript space -- wrapped in a closure as needed. (In normal operation, the Greasemonkey instance is often gone by the time any timers, it has set, fire.)

So, if the page's main JavaScript is disabled, the timer will never run.

Possible workarounds:

• Use GM_xmlhttpRequest as a crude delay. You can setup a page that deliberately draws out its response. So code like:

  GM_xmlhttpRequest
  (
      {
          method: "GET",
          url:    "http://YourTestServer.com/DelayService.php?Seconds=2",
          onload: function (response) {YourDelayedFunctionHere (); }
      }
  );
  

  Would call a utility page that you set up to do the delay for you.

• Use NoScript to disable all of the page's JavaScript except for the main page. For example, for page, YourSite.com/testpage.htm, which includes scripts from, say, *SpamGenerator.net... Allow scripts from YourSite.com but block them from SpamGenerator.net.