Access Npapi From Pages Dom

I'm attempting to override the default functionality for webkitNotifications.createNotification and via a Chrome extension I'm able to inject a script in the pages DOM that does so

Solution 1:

Once your extension includes a NPAPI plugin, it is no longer safe :) But your correct, instead of allowing every single page have access to the plugin, it is better to let your extension have it. I assume you know about the "public" property which specifies whether your plugin can be accessed by regular web pages, the default is false.

Below, I will explain whats your problem, it isn't a accessing NPAPI from DOM pages problem, it is basically why can't your notifications access your content script or extension pages.

As you noticed, access to the content scripts and the pages DOM are isolated from each other. The only thing they share, is the DOM. If you want your notifications override to communicate to your content script, you must do so within a shared DOM. This is explained in Communication with the embedding page in the Content Scripts documentation.

You could do it the event way, where your content script listens on such event for data coming from your DOM, something like the following:

var exportEvent = document.createEvent('Event');
exportEvent.initEvent('notificationCallback', true, true);
window.webkitNotifications.createNotification = function (iconUrl, title, body) {
  var n = window.webkitNotifications.createNotification(iconUrl, title, body);
  n.show = function() {
    var data = JSON.stringify({title: title, body: body, icon: iconUrl});
    document.getElementById('transfer-dom-area').innerText = data;
    window.dispatchEvent(exportEvent);
  };
  return n;
}
window.webkitNotifications.createHTMLNotification = function (url) {
  var n = window.webkitNotifications.createHTMLNotification(url);
  n.show = function() {
    var data = JSON.stringify({'url' : url});
    document.getElementById('transfer-dom-area').innerText = data;
    window.dispatchEvent(exportEvent);
  };
  return n;
};

Then your event listener can send that to the background page:

// Listen for that notification callback from your content script.window.addEventListener('notificationCallback', function(e) {
  var transferObject = JSON.parse(transferDOM.innerText);
  chrome.extension.sendRequest({NotificationCallback: transferObject});
});

I added that to my gist on GitHub for the whole extension (https://gist.github.com/771033), Within your background page, you can call your NPAPI plugin.

I hope that helps you out, I smell a neat idea from this :)