Error injecting script

[nikolay-n]

Error injecting script after Safari update: "Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy."

System Information:

macOS version: 10.14.6
Userscripts version: 2.1.1
Safari version: 14.0 (14610.1.28.1.9)

[quoid]

@nikolay-n

That error is relevant to the website's content security policy. The ability to inject javascript is dependent on the content security policy of the website where you want to inject. That is outside of the control of this extension or anyone beyond the website owner.

This extension will attempt a workaround if a strict CSP is detected and attempt another method of injection - however, you will still see this error in the console, even if the workaround was successful. If the fallback approach is used, context changes and certain things will not be possible - read this for more information (specifically "Problem 2").

Can you please provide the url of the website in question and the code you are attempting execute?

[quoid]

Here's a good example - github.com has a strict content security policy. It does not allow inline javascript. By default, this extension attempts to write inline javascript. This results in the code not executing.

Since 2.0, I made changes to detect security policy violations which utilizes a fallback method if this occurs. This can be demonstrated with the following userscript. Even though you see the error in the console, which is needed to trigger the fallback approach, the code is still executed.

Give it a try.

// ==UserScript==
// @name        Strict CSP Demo
// @description This userscript will still execute on a website with a strict CSP - check your console to see the error
// @match       *://*github.com/*
// ==/UserScript==

alert("This worked, but you will still see any error in the console!");

[nikolay-n]

I've tried to figure out what's wrong and seems some logic before fallback eval method don't works like expected

[quoid]

@nikolay-n please provide the url of the website and the userscript (or shortened version), that will get us to the resolutions a lot quicker

[nikolay-n]

It's Google spreadsheet document https://docs.google.com/spreadsheets/d/...

// ==UserScript==
// @name        GoogleDocsExtensions
// @description Adds some features to Google Docs
// @match       https://docs.google.com/spreadsheets/d/*
// ==/UserScript==

console.log("Hello from script!");

[quoid]

Thanks! Give me a little to look into this - I assume any spreadsheet doc will work for testing

[quoid]

Working as expected in macOS 10.15.6 - I am going to try with macOS 10.14.6 in a little.

[nikolay-n]

The script worked before Safari update

[quoid]

@nikolay-n

I tested on 10.14.6 running Safari 14.0 and I am getting expected results, first image, below. Can you provide the following?

1. Can you please create a new script and keep the "universal" match pattern (*://*.*) and put a simple console.log in there to see if that works? Let me know if that log messages shows in a google spreadsheet.

2. Could you also take a screenshot of the userscript editor metadata with invisibles turned on? (second image below)

[nikolay-n]

using

// ==UserScript==
// @name        TestScript
// @description This is your new userscript, start writing code
// @match       *://*.*
// ==/UserScript==

console.log("Hello there!")

on domain https://www.lipsum.com

on google docs not works and variables has content

on GitHub works and variables has other content

[quoid]

@nikolay-n

how are you logging those ext and src??

[nikolay-n]

Breakpoint in Dev tools

[nikolay-n]

Fix for this weird case (ext.startsWith(src) || src.startsWith(ext))

[quoid]

@nikolay-n I can't reproduce the issue - everything is working as intended on both 10.14.6 and 10.15.6 with safari 14 here

[nikolay-n]

Ok, thanks! I'm lucky man. I need to find a workaround for myself.