Javascript bookmarklet on site with CSP in Firefox

Question

I have a simple Javascript bookmarklet that I put together to run the contents of an appropriate GitHub repository against an external tool:

javascript:(function(){ 
    var isApex = false;
    var sourceLangs = document.getElementsByClassName('lang');
        for (var i = 0; i < sourceLangs.length; ++i) {
        var l = sourceLangs[i]; 
        if(l.innerHTML == 'Apex') {
            isApex = true;
            // alert('This is an Apex repo');
        }
    }
    if(location.hostname != 'github.com' || isApex == false) {
        alert('This is not a GitHub Apex repository!');
    }
    else {
         window.open('https://githubsfdeploy.herokuapp.com/app/githubdeploy'+location.pathname);
    }

})();

When I run it in Chrome or IE (after running it through Daring Fireball's JS bookmarklet builder, it works fine. In Firefox, it generates Content Security Policy errors:

[15:33:19.318] Content Security Policy: Directive inline script base restriction violated @ https://github.com/Groundwire/Campaign-Combiner

I've read this SE question on the topic, and the github blog post about CSP, which acknowledges that CSP shouldn't interfere with bookmarklets, but at that time (April 2013), "none of the browsers get this correct." Is it currently the case that Firefox still gets this wrong, but Chrome & IE do?

I also found a blog post about user scripts & CSP, and there the author was able to deal with the issue by including the code from a github repo. I tried that, modifying my bookmarklet to:

javascript:document.body.appendChild(document.createElement("script")).src="https://raw.github.com/tet3/GitHubInstallerBookmarklet/master/GHIBkmarklet.js";void(0)

But unsurprisingly, that didn't work for a bookmarklet, as the calling code is still coming from the browser.

In short - any ideas on how to get this bookmarklet to work on Firefox?

Firefox 69 and newer doesn't block bookmarklets anymore on pages with strict CSP (https://bugzilla.mozilla.org/show_bug.cgi?id=1478037), although with some limitations. — Rafael, Sep 26 '20 at 21:24

DG. · Accepted Answer · 2013-11-07T01:41:17.870

I've looked at this issue as well, mostly in Firefox. I wasn't aware it would work in Chrome; that might be a recent change. Short of FF changing to recognize bookmarklets as being outside the policy (as it should!), there is no work around. The script won't run, full stop, you are dead in the water.

Alternatives:

1.) Create an addon; or utilize an existing addon like Greasemonkey to run a userscript.

2.) Run the code in the web console. In FF, CTRL+Shift+K gets you there in a jiffy.

3.) FF's developer scratch pad also works. If you save the code in a file, you can access it relatively quickly using Shift+F4 (open scratchpad) > File > Open Recent > select your file > CTRL+R (run).

score 2 · Answer 2 · edited May 23 '17 at 11:51

2

As a workaround to CSP blocking bookmarklets, you can tell your bookmarklet to load an external CSS stylesheet with your JS code injected into it. This is how my Top News Feed bookmarklet does. See my other answer.

edited May 23 '17 at 11:51

Community

1
1

answered Aug 14 '14 at 18:44

niutech

28,923
15
96
106

1

What about CSPs that block external CSS too? That seems like a sensible policy for sites who want to prevent *all* external scripts. – David Foerster May 14 '18 at 11:15

score 1 · Answer 3 · answered May 09 '15 at 05:37

I have created a work-around "fix" for this issue using a Greasemonkey userscript (in Firefox). You can now have bookmarklets on all CSP and https:// sites, plus have your bookmarklets in a nice, easily-editable library file instead of being individually squished into a bookmark.

See: http://www.donnelly-house.net/programming/js/bookmarklets/bookmarklets.php

Javascript bookmarklet on site with CSP in Firefox

3 Answers3