How to check whether inline JavaScript is disabled (with Tampermonkey)

Question

I have a Tampermonkey userscript that runs at document-start.
How can I check whether inline JavaScript is disabled?

Answer 1

This is problematic because certain (¿most?) methods of blocking inline JS: (a) don't block unsafeWindow ops and (b) throw exceptions that aren't caught by try ... catch blocks in the Tampermonkey script.

So the following works but if inline JS is disabled, you will see errors like:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' *". Either the 'unsafe-inline' keyword, a hash ('sha256-6BrJXtaiqFeKY4qCquiR3JgWK2KweFWHCvhZWr4tkxA='), or a nonce ('nonce-...') is required to enable inline execution.

in the console. Such errors are annoying but they do not stop the Tampermonkey script.

Working Demo code:

// ==UserScript==
// @name        Test local JS
// @match       *://stackoverflow.com/questions/*
// @run-at      document-start
// @grant       unsafeWindow
// ==/UserScript==

let gbl_InlineJS_Works = true;
try {
    unsafeWindow.TM_youAliveCanary = true;
}
catch (zError) {
    console.log ("Local JS fails: " + zError);
    gbl_InlineJS_Works = false;
}

if (gbl_InlineJS_Works) {
    var tstScript = document.createElement ('script');
    tstScript.textContent = "TM_canaryIsAlive = true;";
    try {
        document.documentElement.appendChild (tstScript);
    }
    catch (zError) {
        console.log ("Local JS fails: " + zError);
        gbl_InlineJS_Works = false;
    }
    if (gbl_InlineJS_Works) {
        if ( ! unsafeWindow.TM_canaryIsAlive) {
            gbl_InlineJS_Works = false;
        }
    }
}

console.log (`Inline javascript ${gbl_InlineJS_Works ? "works!" : "is blocked."}`);

Answer 2

One way would be to access the page's headers. To do that you would have to issue a http request Accessing the web page's HTTP Headers in JavaScript

You could also look at some of these solutions How to detect Content Security Policy (CSP)

-- Update 1

This is basically untested. I ran it against facebook.com

function inlineScriptEnabled() {
  let req = new XMLHttpRequest();
  req.open('GET', document.location, false);
  req.send(null);
  let header = req.getResponseHeader('content-security-policy');
  if (!header)
    return true;
  let regex = /(^|\s)'unsafe-inline'(;|\s|$)/i; 
  return !!header.match(regex);
}
console.log(inlineScriptEnabled());

You should also search your document for meta tags as described here. https://developers.google.com/web/fundamentals/security/csp/#the_meta_tag The logic would be similar.