chocolateboy / userscripts

Userscripts for Greasemonkey, Tampermonkey etc.
https://greasyfork.org/users/23939-chocolateboy
GNU General Public License v3.0
206 stars 11 forks source link

Firefox: bypassing CSP #15

Closed aminomancer closed 3 years ago

aminomancer commented 3 years ago

Hey there, I have this longstanding goal to make a script (or webextension if necessary) to implement a "plaintext dark mode." I use dark reader and some various site-specific scripts to deal with really bright web layouts but with Firefox I run into this issue on plaintext pages for domains like raw.githubusercontent.com. userContent is blocked, dark reader is blocked, violentmonkey is blocked. It shouldn't be so hard to do this, because we can check for plaintext.css in document.styleSheets. So initially I figured listening to onHeadersReceived would let me intercept and change the directive on time for the content script to load, execute, check for plaintext.css, and register a new stylesheet. But in practice it's slow, so there's a flash of white while the page is loading, before the new stylesheet is set up.

Since I have recently been working with some internal firefox modules I figured it might be easier to just find a way to get at it from the privileged context. Like, instead of using webextensions APIs and content scripts, just run a script in the main UI context and see if I can traverse into the browsers and read their stylesheets. I already know I can read their URLs and use simple event listeners for page loads. But URL alone isn't really good enough so I'm still trying to figure out how to read page stylesheets "from above." Haven't found any documentation that proved to be useful, I guess because it's basically hacking the browser and potentially damaging security.

But anyway before I waste a lot of time on this wild goose chase I wonder if you already figured out a solution. I saw the issues you posted on the violentmonkey repo so I figured you'd already have a sense of whether this can be achieved with a webextension. I'd prefer to do this without a privileged script, but @inject-into doesn't seem to help whatsoever since it won't even match the userscript to a plaintext file in the first place.

chocolateboy commented 3 years ago

No idea, sorry.