[Firefox] seems specially crafted CSP rules make Tampermonkey scripts fail to run #418

rand256 · 2017-07-18T16:43:32Z

I've found a site where the simpliest script just completely fails to run.

Example userscript:

// ==UserScript==
// @name         godvillegame
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       You
// @match        https://godvillegame.com/
// @grant        none
// ==/UserScript==

(function() {
    'use strict';
    // Your code here...
    console.log('asdf');
})();

Here's what is written to the browser console log:

> Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified  (unknown)
> Content Security Policy: Directive ‘frame-src’ has been deprecated. Please use directive ‘child-src’ instead.  (unknown)
> Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src 'unsafe-eval' 'unsafe-inline' https://godvillegame.com 'sha256-gfxb2zFv/yoINJHakyev+mQ0L6bEJ2nYlyoGOsl0GF4=' 'sha256-hzbYwosVtrs+58f6nBH0OWtcXDMPRup0StaR4boJv84=' 'sha256-9WMiX3LBTYJXnZojDLczdoRQ7wLa7WNnGHrRCxWFXcQ=' 'sha256-xja5o6I4Fp5n1IA4D2R4iG/HgUK4unuqkP/49L2c7IM=' http://ajax.aspnetcdn.com https://ajax.aspnetcdn.com https://www.google.com https://www.gstatic.com http://www.google-analytics.com https://www.google-analytics.com https://ssl.google-analytics.com http://connect.facebook.net https://connect.facebook.net https://graph.facebook.com”). Source: (function(a,r,n,G){var c={safeWindow:{},.... godvillegame.com:1
> content: normal start event processing for 10cd3590-d37d-4cf8-b88c-dda0404fbce6 (1 to run)  content.js:26:193
> content: Start ENV normally 10cd3590-d37d-4cf8-b88c-dda0404fbce6   content.js:12:441
> Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src 'unsafe-eval' 'unsafe-inline' https://godvillegame.com 'sha256-gfxb2zFv/yoINJHakyev+mQ0L6bEJ2nYlyoGOsl0GF4=' 'sha256-hzbYwosVtrs+58f6nBH0OWtcXDMPRup0StaR4boJv84=' 'sha256-9WMiX3LBTYJXnZojDLczdoRQ7wLa7WNnGHrRCxWFXcQ=' 'sha256-xja5o6I4Fp5n1IA4D2R4iG/HgUK4unuqkP/49L2c7IM=' http://ajax.aspnetcdn.com https://ajax.aspnetcdn.com https://www.google.com https://www.gstatic.com http://www.google-analytics.com https://www.google-analytics.com https://ssl.google-analytics.com http://connect.facebook.net https://connect.facebook.net https://graph.facebook.com”). Source: onfocusin attribute on DIV element.  godvillegame.com
> content: detected DOMContentLoaded 10cd3590-d37d-4cf8-b88c-dda0404fbce6   content.js:10:46
> Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src 'unsafe-eval' 'unsafe-inline' https://godvillegame.com 'sha256-gfxb2zFv/yoINJHakyev+mQ0L6bEJ2nYlyoGOsl0GF4=' 'sha256-hzbYwosVtrs+58f6nBH0OWtcXDMPRup0StaR4boJv84=' 'sha256-9WMiX3LBTYJXnZojDLczdoRQ7wLa7WNnGHrRCxWFXcQ=' 'sha256-xja5o6I4Fp5n1IA4D2R4iG/HgUK4unuqkP/49L2c7IM=' http://ajax.aspnetcdn.com https://ajax.aspnetcdn.com https://www.google.com https://www.gstatic.com http://www.google-analytics.com https://www.google-analytics.com https://ssl.google-analytics.com http://connect.facebook.net https://connect.facebook.net https://graph.facebook.com”). Source: if (!window.c_loaded){ window.c_load....  godvillegame.com:161

All addon settings are at defaults (except debug level).
Any ideas how to fix it?

The text was updated successfully, but these errors were encountered:

derjanb · 2017-07-18T17:24:27Z

In normal a page's CSP should not interfere with extensions, but that's the case at Firefox. That's why TM needs to workaround this and unfortunately there is a bug. 🙄😁

Will be fixed at the next beta version at the development channel.

Tanookirby · 2017-08-15T23:26:47Z

I have tested a script on the beta version on both Firefox and Chrome. It is called Autopagerize, and there are certain sites that won't work on it even on beta.

The script: https://greasyfork.org/en/scripts/28887-autopagerize-modified-by-blademight

Sample site: http://esoaparte.com/paella_01.html

derjanb · 2017-08-16T20:37:58Z

@Tanookirby I'm sorry, but your issue is not related to CSP, but a script issue. It's even not working with Greasemonkey at the mentioned page.
Please ask the script author for a fix.

Tanookirby · 2017-08-17T00:51:28Z

The author has fixed the issue. There is, however, another issue with sites such as https://addons.mozilla.org/en-US/firefox/extensions/?sort=hotness . In Firefox, the Autopagerize script will work on Greasemonkey but not on Tampermonkey. Because I thought this would be a CSP issue, I tested it with Tampermonkey Beta, which was said to solve the problem; and it still won't work.

tophf · 2017-08-17T04:31:40Z

@Tanookirby, WebExtensions can't run on AMO, the browser explicitly forbids that. Just like Chrome with its own web store.

Lartza · 2017-08-20T18:45:38Z

Firefox 57.0a1, Tampermonkey 4.4.5533beta and AAK-Cont(uBlock Origin version) causes Nextcloud to be unable to load it's scripts.
Content Security Policy: The page’s settings blocked the loading of a resource at https://sub.domain.com/core/vendor/core.js?v=9b6cd8b2827567b5f7aedce892bbb054-10 (“script-src 'unsafe-inline' 'unsafe-eval'”).
Disabling AAK-Cont in Tampermonkey or disabling "Add Tampermonkey to the site's content security policy (CSP) if there is one" fixes script loading in NC.

derjanb · 2017-08-21T08:59:21Z

@Lartza Fixed. Please check the latest version from the development channel.

Lartza · 2017-08-21T09:11:09Z

@derjanb Can confirm 4.4.5546beta fixes the issue :) Thank you

Eeems · 2017-09-01T16:06:35Z

I'm on the latest version in the development channel and I'm getting CSP errors. I'm running Firefox Nightly build 57.0a1 (2017-09-01) (64-bit).
Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src http://vandiepen.ca 'unsafe-eval' 'nonce-NTlhOTg1MGZkNzc2NA=='”). Source: (function(a,q,n,A){var c={safeWindow:{},....
Could it be due to the nonce?
I don't currently have the site live to give you a proper test case, but if it's required I can do so.

derjanb · 2017-09-01T19:15:40Z

@Eeems Hi, this is due to a known bug in Firefox. However, it should not break anything. If this log message bothers you, you can set "Config mode" to "Advanced" and then "Inject Mode" to "Instant" to workaround this issue.

fireattack · 2017-11-30T07:27:37Z

@derjanb it does break some scripts, not just logs. for example:

install this us: https://greasyfork.org/en/scripts/30358-itunes-cover-caption-image-links/code
Open https://itunes.apple.com/us/album/reputation/1274999981

This script is supposed to add link on "x songs" that leads to large size cover art:

It doesn't work in Firefox unless I changed to instant inject mode.

derjanb · 2017-12-01T19:44:08Z

Fixed at the most recent beta version: 4.5.5637beta

fireattack · 2018-02-05T02:09:21Z

I think it's may already known for you, but I still encounter CSP problem on Firefox occasionally on beta 4.6.5694.

The script is this one I wrote myself: https://github.com/fireattack/scripts/blob/master/itunes_cover_art_click_to_show_original.user.js

Test page: https://itunes.apple.com/jp/album/the-idolm-ster-live-the-ter-performance-01-single/1125337612

Warnings from console:

Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src”). Source: call to eval() or related function blocked by CSP. 1125337612:11
Content Security Policy: The page’s settings blocked the loading of a resource at self (“script-src”). Source: window["__u__1935881.4830085929"] = func.... 1125337612:1

Edit: manually change to "instant" inject mode can fix it. So basically the status as I mentioned before at #418 (comment)

fireattack · 2018-02-05T02:17:26Z

On a side note, I sometimes can even reproduce this bug on Chrome (albeit ver. 4.5):

But normally freshing the page can fix it (unlike Firefox, which is consistently error). I have no idea why, though.

derjanb · 2018-02-05T18:37:51Z

Hi, the fix for this issue broke many pages. Therefore it's now a experitmental config option until the used Firefox API becomes stable.

Please set "Config Mode" to "Advanced" and scroll down to the "Experimental" section and now please change "Add Tampermonkey to the sites content CSP" to "Yes".
This should fix at least the Firefox issue, but as I said, depending on your Firefox version, it might also break some pages.

raszpl · 2018-04-02T15:16:12Z

Chrome(vivaldi), tempermonkey 4.5(also beta 4.6.5752), "Add Tampermonkey to the sites content CSP" set to "Yes".
https://www.hltv.org/blog/13538/cheating-on-professional-level-of-csgo
https://github.com/elundmark/Convert-Youtube-Embeds-to-Image-Links-UserScript
My script does document.location.replace("data:text/html;utf8,"+encodeURIComponent(iframeHtml));

Refused to frame 'data:text/html;utf8,%3C!DOCTYPE%20html%3E%3Chtml%20style%3D'margin%3A0!important%3Bpadding%3A0!important%3Boverflow%3Ahidden!important%3B'%3E%3Chead%3E%3Cmeta%20charset%3D'utf-8'%3E%3Cmeta%20name%3D'viewport'%20content%3D'width%3Ddevice-width%2C%20initial-scale%3D1'%3E%3Ctitle%3EPrOverwatch%20%23002%3A%20shox%20-%20YouTube%3C%2Ftitle%3E%3C%2Fhead%3E%3Cbody%20style%3D'margin%3A0!important%3Bpadding%3A0!important%3Bbackground%3A%23FFF%3Boverflow%3Ahidden!important%3B'%3E%3Ca%20href%3D%22magnet3%3Ahttps%3A%2F...e-space%3Anowrap!important%3Btext-overflow%3Aellipsis!important%3Bborder-bottom%3A1px%20solid%20%23000000!important%3B%22%3E%3Cem%20style%3D%22font-style%3A%20normal%20!important%3B%20color%3A%20rgba(255%2C%20255%2C%20255%2C%200.8)%20!important%3B%22%3E2%3A07%20%20%3C%2Fem%3EPrOverwatch%20%23002%3A%20shox%3Cem%20style%3D%22font-style%3A%20normal%20!important%3B%20color%3A%20rgba(255%2C%20255%2C%20255%2C%200.8)%20!important%3B%22%3E%20-%20140%20views%3C%2Fem%3E%3C%2Fa%3E%3C%2Fa%3E%3C%2Fbody%3E%3C%2Fhtml%3E' because it violates the following Content Security Policy directive: "frame-src *".

EDIT: never mind, read some more and CSP is a mess. I just switched from injecting DATA: blob to modifying iframe directly :/

 var doc = document.getElementsByTagName('html')[0];
     doc.getElementsByTagName('head')[0].innerHTML = "<title>Example</title>";
     doc.getElementsByTagName('body')[0].innerHTML = "<p>This is an example.</p>";

mikhoul · 2018-05-09T18:37:08Z

@derjanb Just a quick question I'm new with TM I was using GM with Firefox but I'm migrating to Chromium and I'd like to know what is the most efficient setting for Chrome/Chromium for the CSP ?

My understanding is that with the security setting to yes TM inject headers to allow Userscripts on page like github.com since Firefox don't respect the standard for CSP and scripts. If my understanding is fine this setting is mainly for Firefox and Chrome/Chromium users should set it to "NO" to diminish the useless overhead of adding/injecting headers to allow Userscripts with Chromium.

Could you confirm or infirm my assumptions ?

One more extra question: If I import my Userscripts with a zip file does my settings in Userscripts that use DB will be imported too ?

Like here I have lot of sites saved over the years in my userscripts:

Regards

Hapstyx · 2018-06-01T20:32:51Z

For some reason disabling uBlock Origin on the page seems to be a workaround, at least it solves this issue for me, even when using Tampermonkey's default settings (Windows 7 64bit, Firefox 60.0.1, Tampermonkey v4.6.5757).

derjanb · 2018-06-04T11:08:33Z

My understanding is that with the security setting to yes TM inject headers to allow Userscripts on page like github.com since Firefox don't respect the standard for CSP and scripts. If my understanding is fine this setting is mainly for Firefox and Chrome/Chromium users should set it to "NO" to diminish the useless overhead of adding/injecting headers to allow Userscripts with Chromium.

@mikhoul Even if scripts at Chrome should work with this option set to "No" it's better to keep it on, because it simplifies the script injection.

If I import my Userscripts with a zip file does my settings in Userscripts that use DB will be imported too ?

If the zip was created by Tampermonkey: yes.

derjanb · 2018-06-04T11:10:01Z

For some reason disabling uBlock Origin on the page seems to be a workaround, at least it solves this issue for me, even when using Tampermonkey's default settings (Windows 7 64bit, Firefox 60.0.1, Tampermonkey v4.6.5757

@Hapstyx Edit: nevermind, I can reproduce this now.

Hapstyx · 2018-06-04T11:35:33Z

@derjanb I use the default configuration and filters, though it seems to be caused by EasyList and not uBlock filters. Also works on Ubuntu 18.04 and Debian stretch with both Firefox Nightly and Firefox Developer Edition

one-github · 2018-06-07T07:13:34Z

Is there an unstable version for Safari as well? I use 4.6.5757 on Safari and also (still?) have this issue... I cannot seem to find the configuration option "Add Tampermonkey to the sites content CSP".

derjanb · 2018-06-07T07:39:20Z

@one-github Safari does not support web request modification which is required to modify the CSP. :(

one-github · 2018-06-07T07:51:45Z

@derjanb Does this mean this issue will not be solvable for Safari?

derjanb · 2018-06-07T08:12:19Z

@one-github Please see #296

derjanb · 2018-06-07T15:44:57Z

For some reason disabling uBlock Origin on the page seems to be a workaround

@Hapstyx Should be fixed at TM BETA 4.7.5788 (http://tampermonkey.net/index.php?browser=firefox)

jsamr · 2018-08-26T16:07:08Z

@derjanb
A folk on this bugzilla ticket suggested to use contentScripts API to bypass this restriction.

Can’t you use the the contentScripts API¹?
¹ https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/contentScripts

derjanb · 2018-09-05T20:26:22Z

A folk on this bugzilla ticket suggested to use contentScripts API to bypass this restriction.

That wouldn't help. Maybe bugzilla ticket 1353468 will be a solution.

Arthaey · 2019-10-25T14:35:18Z

So 1353468 was marked as a dupe of Bugzilla ticket 1437098, which looks done or nearly so!

It looks like we should be able to the new userScripts API: overview and example docs are available. (Verify in about:config that extensions.webextensions.userScripts.enabled is true.)

My Tampermonkey userscripts keep breaking because of CSP errors, so it would be awesome if it could move to the userScripts API. :)

satnatantas · 2020-02-04T20:40:48Z

@Arthaey "Closing as resolved-fixed, because as mentioned in comment 29 the API has been already enabled by default" - am I right that Tampermonkey now needs to use that API? Asking because I am still getting CSP errors.

alexolog · 2020-05-29T18:55:32Z

I am getting CSP errors as well, and scripts fail.

dlenski · 2020-06-11T19:42:26Z

@alexolog, I had to update from 4.10.6105→4.11.6114 and then completely clear the Firefox cache in order to fix some an issue with userscripts not running on CSP-secured pages.

https://www.tampermonkey.net/changelog.php?version=4.11.6114&ext=fire&updated=true&old=4.10.6105&intr=true

alexolog · 2020-06-12T03:44:40Z

Clearing the cache seems to have been the missing ingredient.

alexolog · 2020-06-12T22:53:19Z

Too quick to post. FF dev updated itself to 78.0b6 and now none of my scripts run on Google unless I disable CSP globally.

I am running the 4.11.6114 beta

Example page:
https://www.google.com/search?tbm=isch&q=cat&tbs=imgo:1

Sample scripts that fail to run:

Errors in the log:

Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified

GreaseMonkey works.

derjanb added the bug label Jul 18, 2017

derjanb added this to the 4.4 milestone Jul 18, 2017

derjanb added the fixed at beta label Aug 4, 2017

ivysrono mentioned this issue Aug 5, 2017

Scripts do not work on Firefox violentmonkey/violentmonkey#107

Closed

7 tasks

silverwind mentioned this issue Aug 13, 2017

Tampermonkey option do not open firefox 56 b2 64bit StylishThemes/GitHub-Dark-Script#41

Closed

derjanb removed the fixed at beta label Aug 20, 2017

derjanb added the fixed at beta label Aug 21, 2017

Dezaimasu mentioned this issue Sep 4, 2017

В свежей лисе съедаются картинки по прямым линкам SthephanShinkufag/Dollchan-Extension-Tools#1103

Closed

derjanb closed this as completed Sep 22, 2017

derjanb reopened this Nov 30, 2017

derjanb modified the milestones: 4.4, 4.5 Nov 30, 2017

derjanb removed the fixed at beta label Nov 30, 2017

derjanb added fixed at beta bug and removed bug labels Dec 1, 2017

derjanb removed the fixed at beta label Jan 3, 2018

derjanb removed this from the 4.5 milestone Jan 3, 2018

derjanb added this to the 4.6 milestone Jan 3, 2018

ccd0 mentioned this issue May 30, 2018

4chan x not working at all anymore (Firefox) ccd0/4chan-x#1968

Closed

derjanb modified the milestones: 4.6, 4.7 Jun 5, 2018

derjanb changed the title ~~[firefox] seems specially crafted CSP rules make tempermonkey scripts fail to run~~ [Firefox] seems specially crafted CSP rules make Tampermonkey scripts fail to run Jun 7, 2018

derjanb closed this as completed Sep 5, 2018

Arthaey mentioned this issue Oct 25, 2019

[Firefox] Tampermonkey failed with CSP error (again) #700

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Firefox] seems specially crafted CSP rules make Tampermonkey scripts fail to run #418

[Firefox] seems specially crafted CSP rules make Tampermonkey scripts fail to run #418

rand256 commented Jul 18, 2017

derjanb commented Jul 18, 2017

Tanookirby commented Aug 15, 2017

derjanb commented Aug 16, 2017

Tanookirby commented Aug 17, 2017

tophf commented Aug 17, 2017

Lartza commented Aug 20, 2017 •

edited

Loading

derjanb commented Aug 21, 2017

Lartza commented Aug 21, 2017

Eeems commented Sep 1, 2017

derjanb commented Sep 1, 2017 •

edited

Loading

fireattack commented Nov 30, 2017

derjanb commented Dec 1, 2017

fireattack commented Feb 5, 2018 •

edited

Loading

fireattack commented Feb 5, 2018

derjanb commented Feb 5, 2018

raszpl commented Apr 2, 2018 •

edited

Loading

mikhoul commented May 9, 2018

Hapstyx commented Jun 1, 2018

derjanb commented Jun 4, 2018

derjanb commented Jun 4, 2018 •

edited

Loading

Hapstyx commented Jun 4, 2018

one-github commented Jun 7, 2018

derjanb commented Jun 7, 2018

one-github commented Jun 7, 2018

derjanb commented Jun 7, 2018

derjanb commented Jun 7, 2018 •

edited

Loading

jsamr commented Aug 26, 2018

derjanb commented Sep 5, 2018

Arthaey commented Oct 25, 2019

satnatantas commented Feb 4, 2020 •

edited

Loading

alexolog commented May 29, 2020

dlenski commented Jun 11, 2020

alexolog commented Jun 12, 2020

alexolog commented Jun 12, 2020 •

edited

Loading

[Firefox] seems specially crafted CSP rules make Tampermonkey scripts fail to run #418

[Firefox] seems specially crafted CSP rules make Tampermonkey scripts fail to run #418

Comments

rand256 commented Jul 18, 2017

derjanb commented Jul 18, 2017

Tanookirby commented Aug 15, 2017

derjanb commented Aug 16, 2017

Tanookirby commented Aug 17, 2017

tophf commented Aug 17, 2017

Lartza commented Aug 20, 2017 • edited Loading

derjanb commented Aug 21, 2017

Lartza commented Aug 21, 2017

Eeems commented Sep 1, 2017

derjanb commented Sep 1, 2017 • edited Loading

fireattack commented Nov 30, 2017

derjanb commented Dec 1, 2017

fireattack commented Feb 5, 2018 • edited Loading

fireattack commented Feb 5, 2018

derjanb commented Feb 5, 2018

raszpl commented Apr 2, 2018 • edited Loading

mikhoul commented May 9, 2018

Hapstyx commented Jun 1, 2018

derjanb commented Jun 4, 2018

derjanb commented Jun 4, 2018 • edited Loading

Hapstyx commented Jun 4, 2018

one-github commented Jun 7, 2018

derjanb commented Jun 7, 2018

one-github commented Jun 7, 2018

derjanb commented Jun 7, 2018

derjanb commented Jun 7, 2018 • edited Loading

jsamr commented Aug 26, 2018

derjanb commented Sep 5, 2018

Arthaey commented Oct 25, 2019

satnatantas commented Feb 4, 2020 • edited Loading

alexolog commented May 29, 2020

dlenski commented Jun 11, 2020

alexolog commented Jun 12, 2020

alexolog commented Jun 12, 2020 • edited Loading

Lartza commented Aug 20, 2017 •

edited

Loading

derjanb commented Sep 1, 2017 •

edited

Loading

fireattack commented Feb 5, 2018 •

edited

Loading

raszpl commented Apr 2, 2018 •

edited

Loading

derjanb commented Jun 4, 2018 •

edited

Loading

derjanb commented Jun 7, 2018 •

edited

Loading

satnatantas commented Feb 4, 2020 •

edited

Loading

alexolog commented Jun 12, 2020 •

edited

Loading