You may try to convert your bookmarklets to GreaseMonkey userscripts. They run in a privileged environment and are not subject to CSP.
However of course intents of userscripts and bookmarklets are different - userscripts run automatically while bookmarklets on-demand. You may circumvent this e.g. by creating a <button>
in the userscript, appending it to the page, and setting a onclick
event listener on that button to fire the code of the bookmarklet.
Code should go like this:
// ==UserScript==
// @name Name
// @description Description
// @version 0.1
// @namespace example.Lekensteyn
// @grant none
// @include http*://github.com/*/*/commit/*
// ==/UserScript==
var myBookmarklet = function () {
// here goes the code of the bookmarklet
};
var newButton = document.createElement('button');
newButton.innerHTML = 'Execute my bookmarklet';
newButton.addEventListener('click', function(evt) {
myBookmarklet();
});
document.getElementById('someElement').appendChild(newButton);
Taken nearly literally from my userscript which is also targeting GitHub. You can debug userscripts in Firebug using debugger;
keyword in the script.
Note however that Firebug itself is for now also subject to CSP, so you can't e.g. execute code in console (but you can inspect your userscripts in "read-only" mode). This is being taken care of in this bug.