postMessage-tracker-f EN
Hacks and Hops · Firefox
Monitors postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon. All credit goes to Frans Rosén.
<all_urls>），意味着它可以读取你在任意站点的页面内容，包括已登录的页面。这是许多扩展正常工作的必要条件，但也值得你确认来源可信。
截图
简介
postMessage-tracker-firefox
This is a super simple port of the extension with added potentially vulnerable function highlighting. All credit goes to Frans Rosén.
Code
This addon is free and open-source software (FOSS) all code can be found here: https://github.com/ACK-J/postMessage-tracker-firefox/tree/master
Please report your bugs or feature requests in a GitHub issue instead of in a review.
Description
Made by Frans Rosén. Presented during the "Attacking modern web technologies"-talk(Slides) at OWASP AppSec Europe back in 2018, but finally released in May 2020.
This Firefox extension monitors postMessage-listeners by showing you an indicator about the amount of listeners in the current window.
It supports tracking listeners in all subframes of the window. It also keeps track of short-lived listeners and listeners enabled upon interactions. You can also log the listener functions and locations to look them through them at a later stage by using the Log URL-option in the extension. This enables you to find hidden listeners that are only enabled for a short time inside an iframe.
It also shows you the interaction between windows inside the console and will specify the windows using a path you can use yourself to replay the message:
It also supports tracking communication happening between different windows, using `diffwin` as sender or receiver in the console.
Features
- Supports Raven, New Relic, Rollbar, Bugsnag and jQuery wrappers and "unpacks" them to show you the real listener.
- Tries to bypass and reroute wrappers so the Devtools console will show the proper listeners:
- Allows you to set a Log URL inside the extension options to allow you to log all information about each listener to an endpoint by submitting the listener and the function (to be able to look through all listeners later). You can find the options in the Extension Options when right-clicking the extension -> Manage Extension -> Preferences :
- Supports anonymous functions. Chrome (Unsure about Firefox) does not support to stringify an anonymous function, in the cases of anonymous functions, you will see the `bound`-string as the listener:
postMessage-tracker-f 是做什么的
postMessage-tracker-f 是一款面向 Firefox 的开发者工具类扩展，主要用来调试页面、查看样式与请求、测试接口、辅助前端开发。官方对它的介绍是：Monitors postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon. All credit goes to Frans Rosén.在Firefox 附加组件商店（AMO）上，它当前版本 1.1.2，评分 5（1 人评价），约 144 名用户。
适合什么人用
从功能定位看，postMessage-tracker-f 更适合前端工程师、测试与需要经常查看页面结构的用户。如果你平时只是偶尔遇到相关需求，用浏览器自带功能也能凑合；但如果这件事每天都发生，装一个专门处理它的扩展通常比手动操作省事得多。需要注意的是它作用于所有网站，装上后建议先观察一两天，确认不影响常用站点的正常使用。
怎么安装 postMessage-tracker-f
- 打开Firefox 附加组件商店（AMO）上的官方页面；
- 点「添加到浏览器」并确认权限提示；
- 装好后在扩展列表里固定图标，方便随时开关。
本站只做索引与介绍，安装包来自官方商店。如果商店页面提示当前地区不可用，说明该扩展未在你所在区域上架。
常见问题
postMessage-tracker-f 是免费的吗？
postMessage-tracker-f 在Firefox 附加组件商店（AMO）免费提供下载。它是浏览器扩展，装上就能直接用，不需要注册账号。
postMessage-tracker-f 安全吗？
它只申请了 0 项权限，范围比较克制，没有申请「读取所有网站数据」这种大权限。
postMessage-tracker-f 支持哪些浏览器？
当前收录的版本来自Firefox 附加组件商店（AMO），适用于 Firefox。同一个扩展在其他商店可能有对应版本，但功能与版本号不一定相同。
怎么卸载 postMessage-tracker-f？
在扩展管理页找到 postMessage-tracker-f，点移除即可。它在本地保存的设置会一起清掉，不会残留数据。
权限清单 来自 manifest.json 原文
站点访问 1
<all_urls>
接口权限 2
storagetabs