title: In a Firefox WebExtension, how can I safely access value properties of a page-script's JS object?
body: <p>In my extension, I need to access some data stored by page JavaScript. 
  However, I also need to make sure the page cannot trick my extension into running arbitrary code. The data I need should be stored in plain old value properties (if I understand what they are) on a JS object bound to the page's window, but just in case, I want to be sure not to call any malicious code if it's present.</p>
  
  <p>Is there a way to safely access this data from a content script, treating the JS object (and its children) as a simple dictionary?</p>
  
  <p>I've found two pages that might offer some help: </p>
  
  <ul>
  <li><a href="https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Content_scripts#Accessing_page_script_objects_from_content_scripts" rel="nofollow noreferrer">This</a> page describes a method of getting a reference to the page's <code>window</code> object, but it is unsafe to do so.</li>
  <li><a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Xray_vision#Xray_semantics_for_Object_and_Array" rel="nofollow noreferrer">This</a> page appears to show that Xray vision provides safe access to the value properties of an object, but does not seem to explain how to get Xray vision for a page-script object, at least from a content-script rather than actual chrome code.</li>
  </ul>
  
  <p>Is there some way to combine these two to allow safe access to the data?</p>