search

lusakasa / saka-key

A keyboard interface to the web
https://key.saka.io
MIT License
862 stars 70 forks source link

Tooltips broken on crates.io for Firefox #59

Open asymmetric opened 7 years ago

asymmetric commented 7 years ago

If I try to activate the tooltips to follow links (in my case, since I use vimium bindings, f), I instead see the following:

screenshot from 2017-09-29 15-24-57

The tooltips are unstyled and all in a column at the left. They still work though.

Firefox 57.0b4 on Linux.

eejdoowad commented 7 years ago

This is a Firefox-only bug. On Chrome, hints are isolated from page styles using Shadow DOM. Firefox doesn't support Shadow DOM, so I try to reset page styles with reset CSS rules. This is prone to flaws, as showcased by crates.io. I'll have to see which styles are leaking through and account for them.

eejdoowad commented 7 years ago

On follow up, it turns out that the problem is related to crate.io's CSP (Content Security Policy). crates.io has the most robust CSP I've ever seen.

default-src 'self'; connect-src 'self' https://docs.rs https://crates-io.s3-us-west-1.amazonaws.com; script-src 'self' 'unsafe-eval' https://www.google-analytics.com https://www.google.com; style-src 'self' https://www.google.com https://ajax.googleapis.com; img-src *; object-src 'none'

The problem is that Firefox respects the style-src Content Security Policy, which disables inline script tags. It works on Chrome because Chrome ignores style-src. There are two potential fixes:

  1. Use browser.tabs.insertCSS() to insert CSS instead of the inline Githubissues.
  2. Githubissues is a development platform for aggregating issues.