Open tophf opened 3 months ago
Can the issue be tackled from a different angle e.g. a GM_getElement
that would get the element and then the user can do whatever they want with the element?
It can't because the attribute must be set in the JS world of the extension. I've updated the description.
Just from a user perspective, TM can solve most CSP blocking issues by setting Modify existing content security policy (CSP) headers:
to Remove entirely (possibly unsecure)
.
Remove entirely (possibly unsecure).
It's definitely insecure.
Many sites use CSP to forbid setting unknown values in attributes like
src
and even forbid the inlinestyle
attribute entirely (mastodon and derivate sites), which userscripts can circumvent viaGM_addElement
.Problem 1 is that GM_addElement can't change an existing element, so userscripts have to call GM_addElement to create a new element and replace the original, which can be problematic as it resets the state or even redownloads the content e.g. in case we need to change a forbidden
style
onvideo
oriframe
in a site like mastodon.Problem 2 is that userscrips can't just set
src
on an element returned by GM_addElement, because to circumvent CSP the attribute must be set inside the JS world of the extension.Proposing something like
GM_setElement(elem, {attr1: val1, ....})
. For convenience of chaining it can return the original element.CC: @erosman for FireMonkey.