3 ms·

Wait, osascript can inject HTML and Javascript into the DOM? How is that okay?

bri3d 9y ago
Most browsers have remoting capabilities - if you have the access needed to run OSAScript, you could also run ChromeDriver against a local copy of Chrome...
Sidnicious 9y ago
I agree with my sibling comments that in current OSs, desktop apps — especially ones with root — are generally as privileged as the user, and that's (supposed to be!) a good thing. However, Chrome's AppleScript support was used almost exclusively by malware, so it's disabled by default now: https://crbug.com/661810 https://crbug.com/661810.
- sitharus 9y ago
  If Apple had invested as much in AppleScript as other parts of the OS I’m sure we’d see a ‘Can automate other applications’ setting in the Privacy controls. Not sure that’d help much here as the app is a Trojan but it’d be helpful to limit the activity while removing it.
  - CGamesPlay 9y ago
    We have one, to an extent. AppleScript is supposed to be IPC, so the published interfaces for AppleScript are governed by the applications responding to the requests. However, the generic "simulate human input" response is restricted using the "Allow these apps to control your computer" setting in System Preferences -> Security & Privacy -> Privacy -> Accessibility.
sitharus 9y ago
osascript is a desktop automation technology. It can do pretty much anything the current user can do, and the current user can inject things in to the DOM. It’s a very useful thing to be able to do when automating workflows. I just wish Apple invested more in automation.
- jdironman 9y ago
  I wish that they invested more in ARD. It was such a beautiful thing using a single program locally installed to control 500+ machines. But the ARD application over the years has just become more and more broken to the point where I rarely use it and our organization has moved away from Apple towards ChromeOS devices. (I work for a school so that makes since when we implement google classroom and other services.)

Most browsers have remoting capabilities - if you have the access needed to run OSAScript, you could also run ChromeDriver against a local copy of Chrome...

Sidnicious 9y ago

I agree with my sibling comments that in current OSs, desktop apps — especially ones with root — are generally as privileged as the user, and that's (supposed to be!) a good thing. However, Chrome's AppleScript support was used almost exclusively by malware, so it's disabled by default now: https://crbug.com/661810 https://crbug.com/661810.

sitharus 9y ago
If Apple had invested as much in AppleScript as other parts of the OS I’m sure we’d see a ‘Can automate other applications’ setting in the Privacy controls. Not sure that’d help much here as the app is a Trojan but it’d be helpful to limit the activity while removing it.
- CGamesPlay 9y ago
  We have one, to an extent. AppleScript is supposed to be IPC, so the published interfaces for AppleScript are governed by the applications responding to the requests. However, the generic "simulate human input" response is restricted using the "Allow these apps to control your computer" setting in System Preferences -> Security & Privacy -> Privacy -> Accessibility.

sitharus 9y ago

osascript is a desktop automation technology. It can do pretty much anything the current user can do, and the current user can inject things in to the DOM. It’s a very useful thing to be able to do when automating workflows. I just wish Apple invested more in automation.

jdironman 9y ago
I wish that they invested more in ARD. It was such a beautiful thing using a single program locally installed to control 500+ machines. But the ARD application over the years has just become more and more broken to the point where I rarely use it and our organization has moved away from Apple towards ChromeOS devices. (I work for a school so that makes since when we implement google classroom and other services.)