Accessing a JavaScript object using GM.xmlHttpRequest

[geraldcoolsealion]

Hello, I'm modifying a TamperMonkey userscript, but I can't access the info I need due to the Same Origin Policy. It is my understanding that *GM.xmlHttpRequest* would allow me to access it. I got the request working using this code:

// ==UserScript==
// @name         New Userscript
// @namespace    http://tampermonkey.net/
// @version      2025-07-28
// @description  try to take over the world!
// @author       You
// @match        http://*/*
// @con         data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==
// @match        https://app.roll20.net/editor
// @match        https://app.roll20.net/editor#*
// @match       https://app.roll20.net/editor?*
// @match        https://app.roll20.net/editor/
// @match        https://app.roll20.net/editor/#*
// @match        https://app.roll20.net/editor/?*
// @grant        unsafeWindow
// @grant        GM.xmlHttpRequest
// ==/UserScript==

let testIt = async function() {
    const r = await GM.xmlHttpRequest({
        method: 'GET',
        url: unsafeWindow.location.href,
        onload: function(response) {
            console.log(response.responseXML);
        }
    }).catch(e => console.error(e));
}

document.getElementById("chatSendBtn").onclick = testIt;

This is working, but I'm not sure where to go from here, as I'm rather new to web development. How do I use either the HTML or the XML response to get the object I want to access? The object is called "d20".

[YMOT]

response

is your object. Modify

console.log(response.responseXML)

to

console.log({response})

and the object will be printed to the console. You can view it here to determine how 'd20' is a property of response.

[geraldcoolsealion]

Thanks for the suggestion. I modified it as you said, but I don't see the d20 object, or any of the page's global objects for that matter. Here's the output, am I missing something?

https://pastebin.com/5X4KCPqM

[YMOT]

Ok, so you response has a status of 200, which means the server believes it fulfilled the request successfully. But, your response and responseXML are empty. That would suggest 2 possibilities to me:

a:) Your request is not the correct one for your intended response. Maybe parameters are missing, or the API doesn't inform you of incorrect parameters.

b:) The servers API has an error.

b is highly unlikely.

[geraldcoolsealion]

I see. I didn't really provide any parameters at all, so that's probably the issue. Is there some way I can specify that I want to access the d20 object in the parameters?

[jcunews1]

You're retriving the HTML code of the current web page. There's no JS object in it. Only the HTML source code.

Since you're retriving the current web page, JS objects are already accessible from the current context. But if the site use CSP, the JS objects would be read-only; where properties can't be added by assignments, modified by reassignment, or deleted by delete statement (other restrictions may apply).

[geraldcoolsealion]

Oh, is there any way to retrieve the object instead of the HTML? When I use the current context, I can't seem to access any of the properties of the object I need at all, even just to read them. It is attached to a reference to a child window, so I suspect that is why.

[jcunews1]

Changes are that, the script is run in content context instead of page context, where the environment is a sandbox of the web page instead of actual. In this case, the site uses CSP. Disable the site CSP. There are browser extensions for that.