Talk about code development, features, specific bugs, enhancements, patches, and similar things.
Forum rules
Please keep everything here strictly on-topic.
This board is meant for Pale Moon source code development related subjects only like code snippets, patches, specific bugs, git, the repositories, etc.
This is not for tech support! Please do not post tech support questions in the "Development" board!
Please make sure not to use this board for support questions. Please post issues with specific websites, extensions, etc. in the relevant boards for those topics.
Please keep things on-topic as this forum will be used for reference for Pale Moon development. Expect topics that aren't relevant as such to be moved or deleted.
-
BZZZZ
Unread post
by BZZZZ » 2021-11-20, 11:16
this works on sites without CSP:
Code: Select all
Services.obs.addObserver({
"observe":windowWithXray=>{
try{
windowWithXray.eval("console.log(123)")
}catch(err){
console.error(err)
}
}
},"content-document-global-created",false)
but on sites with CSP like
https://developer.mozilla.org/en-US/ it
Error: call to eval() blocked by CSP
how to execute javascript inside window with CSP?
-
Moonchild
- Pale Moon guru
- Posts: 35647
- Joined: 2011-08-28, 17:27
- Location: Motala, SE
Unread post
by Moonchild » 2021-11-20, 11:25
It is working exactly as-intended.
Script injection when CSP is enforced is tricky (on purpose, because that is exactly what CSP is meant to control!). You'll have to see how other extensions get around this.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
-
moonbat
- Knows the dark side
- Posts: 4983
- Joined: 2015-12-09, 15:45
Unread post
by moonbat » 2021-11-21, 00:17
You can directly gain access to the DOM of a page displayed in a tab without trying to inject scripts. Take a look at
Pure URL's code for how to do this. Specifically the pageModifier.init() function.
-
BZZZZ
Unread post
by BZZZZ » 2021-11-24, 13:46
is this good way to inject javascript?
Code: Select all
{
{
const o={}
Components.utils.import("resource://gre/modules/jsdebugger.jsm",o)
o.addDebuggerToGlobal(globalThis)
}
const dbg=Debugger()
Services.obs.addObserver({
"observe":windowWithXray=>{
try{
const result=dbg.makeGlobalObjectReference(windowWithXray).executeInGlobal("console.log(1)")
if(result.throw)console.error(result)
}catch(err){
console.error(err)
}
}
},"content-document-global-created",false)
}
-
Moonchild
- Pale Moon guru
- Posts: 35647
- Joined: 2011-08-28, 17:27
- Location: Motala, SE
Unread post
by Moonchild » 2021-11-24, 16:13
OK this has nothing to do with browser development and you're clearly not listening to suggestions.
Locking thread.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite