Refused to execute a script with when using @inject-into since 3.2.0 version

[mikigal]

System Information:

macOS version: 11.4 (20F71)
Userscripts version: 3.2.0
Safari version: 14.1.1 (16611.2.7.1.4)

I've got Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy. error even with @inject-into property setted to auto and content.

Problem does not exist on older version, logs from older version are below

[quoid]

@mikigal

please include the userscript or a simplified version of it

[mikigal]

@quoid
Problem exists on every of my scrips, it's one of simplier (version for older Userscripts, without @inject-into)

// ==UserScript==
// @name        GitHub Tab Fix
// @description GitHub Tab Fix
// @match       https://github.com/*
// ==/UserScript==

console.log("Executed Userscript!");
let bodies = document.getElementsByTagName("tbody");
if (bodies.length === 0) {
    return;
}

let body = bodies[0];
body.innerHTML = body.innerHTML.replaceAll("\t", "    ")

[quoid]

Problem exists on every of my scrips

Every single script for every single website produces this error?

Or

Every single script for github domain produces this error?

it's one of simplier (version for older Userscripts, without @inject-into)

To be clear, the script you pasted is currently producing an error?

[mikigal]

I have scripts for YouTube, GitHub, jbzd.com.pl and wykop.pl, they don't work on every site.
Pasted script works with Userscripts 3.1.0, on 3.2.0 it produces error, even when I add @inject-into

[quoid]

@mikigal

The script you pasted "works" on GitHub. Also the image you linked also shows that script injection is occurring.

You can see clearly in the image the console output of Executed Userscript!. As for the other code in the userscript, that's irrelevant at the moment, because the issue is with script injection and script injection is seemingly working.

If you use this simplified version of what you pasted, visit github.com, and you see the expected console message, injection is working.

// ==UserScript==
// @name        GitHub Tab Fix
// @description GitHub Tab Fix
// @match       https://github.com/*
// ==/UserScript==

console.log("Executed Userscript!");

it produces error

The error will always show when a website has a strict CSP, but that does not mean that script injection has failed. When a CSP error occurs, the extension automatically attempts a fallback method of script injection (you can tell this by the console.warning message which is present in your screenshot image).

In the case of Github -> has a strict CSP, error gets thrown, fallback method is attempted, script is injected.

I have scripts for YouTube, GitHub, jbzd.com.pl and wykop.pl, they don't work on every site.

Ensure that you are using proper @match values. In 3.2, matching was improved but it also could make old @match values no longer function as expected.

I am able to inject scripts into Youtube, GitHub, jbzd.com.pl and wykop.pl with no issues.

Check out this article for constructing match patterns: https://developer.chrome.com/docs/extensions/mv3/match_patterns/

[mikigal]

Logs which I pasted are from 3.1.0, I wanted to show message about fallback.
On 3.2.0 I've got only Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy. and nothing more. My console.log is not executed.

Maybe my @match get broken in 3.2, I will verify it

[quoid]

I tested all the domains you listed and had no issues with injection. It must be a metadata syntax issue.

If you provide the userscript that is causing issue and the domain you are visiting I can probably tell you very quickly what the issue is.

[mikigal]

I reinstalled 3.2.0 and it started working - I haven't idea what happend, very sorry for problems.
Currently it only throws TypeError, logs below.

Code:

// ==UserScript==
// @name        GitHub Tab Fix
// @description GitHub Tab Fix
// @match       https://github.com/*
// ==/UserScript==

console.log("Executed Userscript!");

[quoid]

Currently it only throws TypeError, logs below.

is this happening every page load?

[mikigal]

It happens about 4-5 times on 10 page reloads

[quoid]

@mikigal

If I had to guess this is happening because the CSP error is getting thrown before the content script gets the userscript data.

are you using any other userscript managers?

[mikigal]

No, I have only AdGuard, Dark Reader and UserScripts extensions

[quoid]

The issue, I reckon, is that something else is triggering the CSP error. When that error happens, the event listener in the Userscripts content script is running the fallback function, but this is happening before the data is received.

I reckon one of the other extensions have extension scripts, you can check this by looking in the developer tools. You will see in the screenshot below, I have 1password extension with a script as well:

If you don't mind checking that I would appreciate it.

Although not the reason of this issue, it exposed another potential bug!