Bookmarklets cannot be executed on sites with restrictive content security policies (CSP)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 27k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
When opening bookmarklets (bookmarks with a javascript:// URL) via the Vomnibar, they will fail to run if the page has a restrictive CSP. The error is
Refused to execute inline script because it violates the following Content Security Policy directive
Examples of pages with restrictive CSPs: github.com, developer.mozilla.org.
This is a new limitation in Vimium v2.0 because we've moved to Manifest v3.
This is a known API limitation with the Manifest V3 and the intention is to eventually resolve it. The design for a userscripts API is being tracked in the w3c extensions repo. As of 2023-10-11, it doesn't look like implementation has yet been started in Chrome.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Vomnibar bookmarklet failure on github.com or developer.mozilla.org and review the Manifest V3 limitation described in this issue. Read the linked W3C WebExtensions userscripts API discussion (issue 279) and check whether Chrome support has changed. Done means bookmarklets execute on pages with restrictive CSPs without the reported inline-script error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100