Tampermonkey script blocked by a CSP error

ZeronoFreya commented 1 year ago

debug using usb:

Content Security Policy: The page’s settings observed the loading of a resource at eval (“script-src”). A CSP report is being sent.
Source: window["__f__li8ilo7s.ev"] = function(){…

Other plugins excluded.

sript code:

// ==UserScript==
// @name         Pinterest
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       Zeronofreya
// @match        https://www.pinterest.com/*
// @exclude      edge://extensions/*
// @icon         https://s.pinimg.com/webapp/favicon-56d11a6a.png
// @run-at       document-end
// ==/UserScript==

(function() {
    'use strict';

    // Your code here...

   console.log("init") // no output

})();

Is there anything else I need to do?

seniordevel commented 1 year ago

``Is there anything else I need to do?

Yes, post this issue to the tampermonkey script author first, and please await his answer.

Usually this happens, if a script or addon violates a sites content security policy. The script author then needs to modify his script - or needs to exclude the site.

The warning "Content Security Policy: The page's settings blocked the loading of a resource: xyz" occurs when the page's CSP configuration given by xyz prevents the resource from being loaded into the document's context.

This usually is NO browser bug.

krystian3w commented 1 year ago

Also possible test "Config mode" at "Advanced" value from WebExtension settings: https://www.tampermonkey.net/#multiple-configuration-modes

and enable experimental option "Add Tampermonkey to the HTML's CSP" if failed on enabled only "Advanced" mode.

Also last with CSP fixes can be 4.19.

fork-maintainers / iceraven-browser

Tampermonkey script blocked by a CSP error #617