Ckeditor Variable Is Available In Console, But Not From A Chrome Userscript?

I'm writing a Chrome userscript to locally auto-save content in a CKEditor. I'm using this CKEditor auto-save plugin as inspiration. I have written a function that fires every half

Solution 1:

According to this little tutorial video on YouTube, all the 3 "devices" are separated from each other in order to prevent XSS attacks from the user script to the browser / website and vice versa. Although the user scripts / content scripts are running in the website's context, they are still kept separated from the actual website script context. You can easily acknowledge this by simply trying to access for example jQuery from a content script. Just as the CKEditor, it will not be available.

So what I've come up with in order to deal with this is using the content script to include external JavaScripts in the head tag. AFAIK, this is not possible for files directly in the extension's root directory, so I've taken a remote server to host my files.

I'm not sure if this is the best approach and I think it is an ugly bypass, possibly way to powerfull and disabled by the Chromium Project some time.

---

(Edited by OP, so I can select this answer and route karma appropriately)

This answer, combined with some of the suggestions and links in the comments, ended up getting me to where I needed to be.

I ended up with the following function:

var insertScriptIntoDocument = function(scriptUrl, doc) {
    // inspired by http://blog.afterthedeadline.com/2010/05/14/how-to-jump-through-hoops-and-make-a-chrome-extension/var scriptText = doc.createTextNode(
        '(function(loc) {                                                    \
    var embeddedScript = document.createElement("script");                   \
    embeddedScript.type = "text/javascript";                                 \
    embeddedScript.src = loc;                                                \
    document.getElementsByTagName("head")[0].appendChild(embeddedScript);    \
})("' + scriptUrl + '");');

    var injectorElement = doc.createElement('script');
    injectorElement.appendChild(scriptText);
    doc.body.appendChild(injectorElement);
};

Usage looks like so:

var embeddedScriptUrl = chrome.extension.getURL("embedded-script.js");
insertScriptIntoDocument(embeddedScriptUrl, document);

For now, I'm executing this from within a Chrome extension, but I suspect that the pattern might work in a GreaseMonkey script deployed via the Chrome TamperMonkey extension provided that the URL of the script to be embedded was hosted somewhere reachable.

FTR, as it turns out, I did not actually need to get to the iframe -- the CKEDITOR variable was defined in the top-level document, but was simply not visible because of the rules of the Chrome sandbox