Greasemetal version 0.2 released
I have just uploaded version 0.2 of Greasemetal to greasemetal.31tools.com. I originally intended to add management UI for userscripts in the second release, but hearing the users' request for improved compatibility with Greasemonkey, I changed my mind. The main focus of the release is to improve compatibility with Greasemonkey. The changes from version 0.1 are as follows.
Improved Compatibility with Greamemonkey
After the initial release a number of users requested support for GM_* functions, to improve compatibily with many existing userscripts written for Greasemonkey. So in version 0.2, we have implemented following functions:
- GM_log
- GM_addStyle
- GM_openInTab
- unsafewindow
The functions were written by my colleague Amachang. He is the developer of a Javascript-based presentation tool S6 (an example) and JavaScript-XPath.
Execution Log of Userscripts
Greasemetal will write execution log of userscripts to the inspection window (to open the window, right click anywhere in the browser window and select Inspect). Greasemetal logs which userscripts are executed, and names the ones that failed and the reason why. Unfortunately the line number at where the error occured cannot be logged, but still I hope it would be helpful for developers makeing their userscripts compatibile with Greasemetal.
Suppress Unnecessary Error Logs
The debug.log file is no more generated. If you find one next to Greasemetal.exe, you are free to remove it. Also you would no more see the error message "Uncaught TypeError: Cannot call method 'setAutomationId' of undefined" in the inspection window increasing forever (although you would see one message per tab, it's inevitable).
Passing Command Line Arguments to Google Chrome
Command line arguments following " - " are passed to Google Chrome. For example, command below will start Google Chrome with Greasemetal but without displaying images.
> Greasemetal.exe - --disable-images
Possibility of Supporting other GM_* Functions and Security Implications
4:43pm added: Now that we have added support for some GM_* functions, the left ones are: GM_xmlHttpRequest, GM_getValue, and GM_setValue. The three functions require a different security model than that of ordinal web scripts (known as same domain policy). Even if we dismissed the pontential danger of not supporting a non-safeWindow, the functions will require a secure channel from userscripts to the internal web server of Greasemetal (that malicious web sites cannot intervene), for storing and accessing persistent data, or performing cross-domain access through the web server. However, since there is no way to enforce the order of JavaScript execution so that the script injected by Greasemetal is run before any scripts on a web page gets executed, it is difficult to create such a channel (a malicious web page might redefine necessary functions for communication, such as document.createElement). In other words, it would be mandatory to implement an encrypted channel (with replay attack-resistency) between the injected JavaScript and the web server, however it would require some ammount of engineering.
This is our current understanding on the technical aspects of supporting the functions, and thus, until these situation changes, we have little (if not any) interest in implementing them.