My browser, my rules, my chrome

Summary: there are times when Firefox security gets in your way. Having a directory where you can place xul, html and scripts to run with chrome privileges enables you to shoot yourself in the foot and to create nice and handy hacks.

The itch that called for scratching: I wanted to hack something to let me upload several files at once to googlepages [1]. The problem is that, for very good reasons, you can not use JavaScript to change the value of input fields of type file: you usualy don't want scripts reading files in your disk. So, a bookmarklet, that to the browser looks as if it were part of the page, wouldn't cut it. Greasemonkey userscripts do run sandboxed, but not under chrome privilege [2], so I did not try that. I tried to give the page UniversalFileRead privilege [3][4], but failed.

A chrome folder. From Under chrome's influence, slightly modified,

In the browser's installation directory, create a new file chrome/mychrome.manifest and put a single line into it:

content mychrome file:///D:/whatever/mychrome/

Note that the trailing slash is significant. Then create the file D:\whatever\mychrome\hello.txt and add some text:

hello world!

After a complete restart of your browser, you can open that file using chrome://mychrome/content/hello.txt.

You need to keep in mind that chrome is catched, so you may not see the changes you make immediately. Setting nglayout.debug.disable_xul_cache to true [5] or the Extension Developer's Extension ability to reload chrome without restarting the browser are helpful here.

Future plans:

• the bulk upload to googlepages is working nicely; needs some docu before uploading it.
• I want to have a browser window with chrome privileges so that I can have more freedom of what I can do with some file: urls. Specifically
  
• have known tiddlywikis granted UniversalXPConnect privilege without having to grant it to everything from file: and without having to mess with the capability.principal.codebase annoyance.
• have local files use a script loaded from the web, or have a remote file load a script from my disk, so that I don't have to upload files while writing/debugging javascript.
  

Footnotes:
[1] googlepages: yeah, I know, I'm cheap!
[2] Mark Pilgrim's slides on sandboxing greasemonkey have a wonderful "how to become an expert" detour. Don't miss it.
And, just in case you are a powerpoint author, consider S5 (a Simple Standards-Based Slide Show System), the tool used for Mark's slides.
[3] UniversalFileRead: I added to my user.js

user_pref("capability.principal.codebase.googlepages1.granted", "UniversalFileRead");
user_pref("capability.principal.codebase.googlepages1.id", "http://pages.google.com/");

but still got a security exception.
[4] Highlighted link thanks to http://citebite.com.
[5] nglayout.debug.disable_xul_cache: I haven't tried it. As I write this,I realize that my user.js sets it to true while my prefs.js ignores it and keeps it to false. I'm clueless here. Update: A ";" was missing at the end of its user_pref line. Life is much better with this setting enabled!