22

Does Mozillas CSP block to execute Javascript from a bookmark by default?

Can it be configured to do so?

5
  • Just curiosity, why would you want to disable bookmarklets? Commented Sep 30, 2011 at 8:17
  • I don't I just worried some one else might do that because they do not want to have Javascript injected on there webpage. Commented Sep 30, 2011 at 8:21
  • 2
    There are always things like greasemonkey. If the user decides that he wants to inject javascript in the website that will only affect himself it's nobody's right to prevent him from doing it. Commented Sep 30, 2011 at 8:24
  • Greasemonkey will have the same problem. They maybe able to rewrite the http header or change the browser settings. Commented Sep 30, 2011 at 8:35
  • I'm sure GM will not. It's a browser extension so it's generally immune to security restrictions - and scripts don't directly execute in the site's context. Commented Sep 30, 2011 at 8:37

4 Answers 4

23

As of 2017, the answer is still a definitive "maybe" - just like when this answer was originally posted in 2011. The specification clearly says:

Policy enforced on a resource SHOULD NOT interfere with the operation of user-agent features like addons, extensions, or bookmarklets.

And this is indeed the behavior I see in Chrome 61: a bookmarklet will run on https://addons.mozilla.org/, a site that has a strict content security policy without script-src: 'unsafe-inline'. Yet in Firefox 56 bookmarklets won't run on this website and a CSP violation is being reported.

There is a very long discussion on this issue in the Firefox bug report, in particular linking to a similar discussion on the W3C spec. So as of now, you cannot really rely on bookmarklets being unaffected by CSP. You can always disable CSP altogether, but that's one important protection layer less for you.

3
  • 1
    Thanks for testing this! BUT you can simply switch of CSP if you want. Open about:config and set "security.csp.enable" to "false". So you will be able to run you own booklets anyway. Commented Sep 30, 2011 at 8:39
  • 4
    @PiTheNumber: My answer already says that you can switch off CSP - and advises not to do so. Commented Sep 30, 2011 at 9:19
  • Sorry, I did not saw you edit when I was writing the comment. Commented Sep 30, 2011 at 9:25
5

The behavior is specified in mozillas wiki.

CSP should not interfere with the operation of user-supplied scripts (such as browser add-ons and bookmarklets).

Have a look here: https://wiki.mozilla.org/Security/CSP/Specification#Non-Normative_Client-Side_Considerations

4

Yes, the CSP blocks bookmarklets in Mozilla Firefox. There is a bug about it.

However, you can get around this restriction by injecting the JS code into an external CSS stylesheet, like my Top News Feed bookmarklet does:

External CSS:

#topnewsfeed { font-family: '(function(){/*payload*/})()'; }

Bookmarklet JS:

(function() {
    var a = document.createElement("link");
    a.rel = "stylesheet";
    a.href = "//niutech.github.io/topnewsfeed/topnewsfeed.css";
    a.onload = function() {
        var a = b.currentStyle ? b.currentStyle.fontFamily : document.defaultView.getComputedStyle(b, null).fontFamily;
        eval(a.replace(/^["']|\\|["']$/g, ""));
    };
    document.body.appendChild(a);
    var b = document.createElement("div");
    b.id = "topnewsfeed";
    document.body.appendChild(b);
})()

The bookmarklet loads a CSS file containing JS code, adds an element styled by this CSS, reads the element style attribute and eval the code.

1
  • 11
    Refused to load the stylesheet 'https://<mysite.com>/bookmarklet.css' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline' 'unsafe-eval' assets-cdn.github.com".
    – Michael
    Commented Mar 21, 2015 at 17:22
0

I have created a work-around "fix" for this issue using a Greasemonkey userscript (in Firefox). You can now have bookmarklets on all CSP and https:// sites, plus have your bookmarklets in a nice, easily-editable library file instead of being individually squished into a bookmark.

See: https://groups.google.com/d/msg/greasemonkey-users/mw61Ynw5ORc/Gl_BNUhtSq0J

1
  • This method not work because the bookmarklet can't be executed (bookmarklet = unsafe-inline)
    – mems
    Commented Jan 17, 2017 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.