Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Today I have noticed that I am unable to run bookmarklets on https://github.com/ due to Content Security Policy (CSP) restrictions. Is there a way to disable CSP in Firefox for just bookmarklets, and not everything else?

I noticed the security.csp.enable option in about:config, but this would disable CSP completely. The following message is logged to console when activating a bookmarklet:

Timestamp: 04/22/2013 02:39:05 PM
Warning: CSP WARN:  Directive inline script base restriction violated

Source File: https://github.com/
Line: 0
Source Code:
javascript:...
share|improve this question
add comment

1 Answer

You may try to convert your bookmarklets to GreaseMonkey userscripts. They run in a privileged environment and are not subject to CSP.

However of course intents of userscripts and bookmarklets are different - userscripts run automatically while bookmarklets on-demand. You may circumvent this e.g. by creating a <button> in the userscript, appending it to the page, and setting a onclick event listener on that button to fire the code of the bookmarklet.

Code should go like this:

// ==UserScript==
// @name            Name
// @description     Description
// @version         0.1
// @namespace       example.Lekensteyn
// @grant           none
// @include         http*://github.com/*/*/commit/*
// ==/UserScript==

var myBookmarklet = function () {
    // here goes the code of the bookmarklet
};

var newButton = document.createElement('button');
newButton.innerHTML = 'Execute my bookmarklet';

newButton.addEventListener('click', function(evt) {
    myBookmarklet();
});

document.getElementById('someElement').appendChild(newButton);

Taken nearly literally from my userscript which is also targeting GitHub. You can debug userscripts in Firebug using debugger; keyword in the script.

Note however that Firebug itself is for now also subject to CSP, so you can't e.g. execute code in console (but you can inspect your userscripts in "read-only" mode). This is being taken care of in this bug.

share|improve this answer
    
The on-demand feature is very important. I have bookmarklets that insert a quick eval-textarea with some features that does not fill the a large part of the page, one for creating a QR code for the current page and some other smaller parts. Those are not GH-specific. The power of bookmarklets is that they can be created and removed very easily. GreaseMonkey was already installed, but that is not going to solve the CSP issue. Thanks for the suggestions, perhaps a solution for Firebug will also be of benefit for bookmarklets. –  Lekensteyn Apr 26 '13 at 9:37
1  
Unfortunately the Firebug fix will only fix Firebug itself. From Github blog entry on CSP: As made clear by the CSP spec, browser bookmarklets shouldn't be affected by CSP. (..) But, none of the browsers get this correct. All cause CSP violations and prevent the bookmarklet from functioning. Perhaps you should investigate the case more thoroughly and report an issue on Bugzilla. –  jakub.g Apr 26 '13 at 12:27
    
BTW you can use GM_registerMenuCommand to make a function invocation on-demand. Don't forget @grant GM_registerMenuCommand. It adds entry to Greasemonkey menu, accesible under (GM logo) > User Script Command.... That way you can easily convert your bookmarklets into userscripts. –  jakub.g Apr 30 '13 at 13:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.