How to disable CSP in Firefox for just bookmarklets?

Question

Today I have noticed that I am unable to run bookmarklets on https://github.com/ due to Content Security Policy (CSP) restrictions. Is there a way to disable CSP in Firefox for just bookmarklets, and not everything else?

I noticed the security.csp.enable option in about:config, but this would disable CSP completely. The following message is logged to console when activating a bookmarklet:

Timestamp: 04/22/2013 02:39:05 PM
Warning: CSP WARN:  Directive inline script base restriction violated

Source File: https://github.com/
Line: 0
Source Code:
javascript:...

Answer 1

You may try to convert your bookmarklets to GreaseMonkey userscripts. They run in a privileged environment and are not subject to CSP.

However of course intents of userscripts and bookmarklets are different - userscripts run automatically while bookmarklets on-demand. You may circumvent this e.g. by creating a <button> in the userscript, appending it to the page, and setting a onclick event listener on that button to fire the code of the bookmarklet.

Code should go like this:

// ==UserScript==
// @name            Name
// @description     Description
// @version         0.1
// @namespace       example.Lekensteyn
// @grant           none
// @include         http*://github.com/*/*/commit/*
// ==/UserScript==

var myBookmarklet = function () {
    // here goes the code of the bookmarklet
};

var newButton = document.createElement('button');
newButton.innerHTML = 'Execute my bookmarklet';

newButton.addEventListener('click', function(evt) {
    myBookmarklet();
});

document.getElementById('someElement').appendChild(newButton);

Taken nearly literally from my userscript which is also targeting GitHub. You can debug userscripts in Firebug using debugger; keyword in the script.

Note however that Firebug itself is for now also subject to CSP, so you can't e.g. execute code in console (but you can inspect your userscripts in "read-only" mode). This is being taken care of in this bug.

Answer 2

Github says that it should work according to the spec, but no browser gets it right:

https://github.com/blog/1477-content-security-policy#bookmarklets

You should open a bug for your favorite browser for this issue, or vote for it:

• Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=866522
• Chromium: https://code.google.com/p/chromium/issues/detail?id=233903

Answer 3

Many answers recommend user scripts (like TamperMonkey or GreaseMonkey) but I want to remember, that some pages are blacklisted for a reason by these extensions. (Sure, you can override the blacklisting, but the devs had security in mind and locked these pages out).

For example, I wanted to use a bookmarklet to quickly go to ReviewMeta from any Amazon listing, but Amazon blocked unsecure script sources (update: it wasn't blocked, but I had no-script on, it's a shame). The user script extensions are blacklisted on banking and shopping sites by default to prevent malicious user scripts from being installed / used.

(P.S. This is not an answer per se but I thought it would be useful to keep this in mind before getting your hands on a userscript just to find the page blacklisted and hesitating from un-blacklisting it.)

Answer 4

I have created a work-around "fix" for this issue using a Greasemonkey userscript (in Firefox). You can now have bookmarklets on all CSP and https:// sites, plus have your bookmarklets in a nice, easily-editable library file instead of being individually squished into a bookmark.

See: https://groups.google.com/d/msg/greasemonkey-users/mw61Ynw5ORc/Gl_BNUhtSq0J

Answer 5

If you want to run your bookmarklets on CSP-enabled websites in Firefox, you can use CSS stylesheets, see my answer on StackOverflow.