关于在 Safari 浏览器上部分网站无法运行油猴脚本的问题说明

Open
#107 19 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
javascript
Domain
security, web-dev

Research direction

Start with the issue's Safari and Content-Security-Policy behavior report, then reproduce the failure on a CSP-enabled site using the userscript extension. Investigate whether Safari provides a supported way to bypass or disable the policy; done requires a verified workaround or clear documentation that none is available.

Written by the indexing model from the issue text.

Description

需要帮助

一直以来都有人反馈我的某个油猴脚本在 Safari 浏览器下无法访问,但是我多次远程协助也没找到原因(我没有 MAC 设备),直到刚才在热心人士的帮助下,经过测试研究,最后发现:

之所以 Safari 浏览器在部分网站下无法运行油猴脚本,均是因为这些网站配置了 Content-Security-Policy(内容安全策略)
在其他浏览器上,CSP 不会影响油猴脚本,因为浏览器扩展在插入油猴脚本时,会忽略网站的 CSP 策略。
但是 Safari 浏览器很奇葩的不与其他浏览器为伍,在浏览器扩展插入油猴脚本时会遵守网站的 CSP 策略,导致油猴脚本被阻止(显然这些网站不会将油猴脚本的路径加入 CSP 策略中)。

查询搜索后发现,似乎目前没有任何方法可以在 Safari 浏览器上绕过/禁用 CSP 策略,因此凡是启用 CSP 策略的网站均无法在 Safari 浏览器上依靠扩展运行油猴脚本
当然如果你有解决方法的话,欢迎在下面告诉我~

Dominant language
JavaScript
Stars
10k
Forks
706
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from XIU2/UserScript

All issues in XIU2/UserScript

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.