4 ms·

How does one use this on modern browers? If I paste it into the Firefox address bar, it interprets it as a search. I can get it to work by stripping off the "

How does one use this on modern browers? If I paste it into the Firefox address bar, it interprets it as a search. I can get it to work by stripping off the "javascript:" prefix and pasting it into the console instead, but only on the site itself; if I try it on a different site the request is blocked by browser security measures. Is there any way to get this to work?

stavros 4y ago
You should create a bookmark with the JS as the target.
jakopo87 4y ago
Manually add "javascript:" at the beginning, it gets stripped when you paste it.
- bmacho 4y ago
  Put a character in the address bar, paste the text, then ctrl+left for a while then hit delete. (Not like it will do anything, but that's how you can put the text in the address bar.) Firefox address bar is broken. When you want to copy an url from it (e.g. wikipedia link) it url encodes the text, and makes it unreadable (especially when your language contains non latin characters). I copy links starting form the 't', and manually add the 'h'. Also when you copy something in the URL bar, then ctrl a then ctrl x, it will copy the original url, instead of your text. But if you do it twice, it will copy your text instead. (Same in windows, linux, even in palemoon.) It looks like a normal input field on the screen, and it tempts me to use it, but bites me most of the times.
  - jakopo87 4y ago
    I tried what you said and it doesn't work with "javascript:" uris (probably to prevent running of unwanted code?). Firefox bar is not "broken", as every browser I tested has the same behavior, and I think it's because a valid uri should only contain ASCII characters (as described in RFC3896[0]), but I agree with you that it's annoying: it should copy the text as it's displayed. Fun fact: Internet explorer let you copy the uri "as is" without encoding. [0] https://www.rfc-editor.org/rfc/rfc3986.html#section-2 https://www.rfc-editor.org/rfc/rfc3986.html#section-2
Cockbrand 4y ago
You can also paste it into the JS console in the dev tools (minus the javascript: at the beginning). Still doesn't work for HTTPS enabled sites.
j-bos 4y ago
Iirc that's a safety feature to tech unsavy users from executing copy pasted code in the url bar. You'll need to manually type javascript: at the beginning. Same applies to chrome.
- Reason077 4y ago
  I couldn't get it to work (with random web pages) in Safari. Trying to paste it to the URL bar gives the error: "Safari doesn’t allow JavaScript from the Smart Search Field. To allow this, choose “Allow JavaScript from Smart Search Field” from the Develop menu." But even after enabling that option, it still doesn't work. Javascript console shows the errors: [Error] Refused to load http://kathack.com/js/kh.js because it does not appear in the script-src directive of the Content Security Policy. [Error] Refused to load http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js because it does not appear in the script-src directive of the Content Security Policy.
  - j-bos 4y ago
    Hmm, I ran into the same issue (without the notification) on chrome and firefox for android..
    - j-bos 4y ago
      Seems the issue is the request being fired off to get the actual script (xss concerns?), my guess is that it would work by copying the requested script into the js url string, rather than requestimg it.
  - aendruk 4y ago
    Content Security Policy is a way for websites to ask the browser to disable certain functionality that the website expects to not need. That website evidently has asked the browser to not run arbitrary third-party (or non-https?) scripts. Ideally your browser would recognize that you, the human operator, have authority to override the requests of strangers on your own computer. Sadly, the days of your user agent actually acting on your behalf are waning.
  - 4y ago

stavros 4y ago

You should create a bookmark with the JS as the target.

jakopo87 4y ago

Manually add "javascript:" at the beginning, it gets stripped when you paste it.

bmacho 4y ago
Put a character in the address bar, paste the text, then ctrl+left for a while then hit delete. (Not like it will do anything, but that's how you can put the text in the address bar.) Firefox address bar is broken. When you want to copy an url from it (e.g. wikipedia link) it url encodes the text, and makes it unreadable (especially when your language contains non latin characters). I copy links starting form the 't', and manually add the 'h'. Also when you copy something in the URL bar, then ctrl a then ctrl x, it will copy the original url, instead of your text. But if you do it twice, it will copy your text instead. (Same in windows, linux, even in palemoon.) It looks like a normal input field on the screen, and it tempts me to use it, but bites me most of the times.
- jakopo87 4y ago
  I tried what you said and it doesn't work with "javascript:" uris (probably to prevent running of unwanted code?). Firefox bar is not "broken", as every browser I tested has the same behavior, and I think it's because a valid uri should only contain ASCII characters (as described in RFC3896[0]), but I agree with you that it's annoying: it should copy the text as it's displayed. Fun fact: Internet explorer let you copy the uri "as is" without encoding. [0] https://www.rfc-editor.org/rfc/rfc3986.html#section-2 https://www.rfc-editor.org/rfc/rfc3986.html#section-2

Cockbrand 4y ago

You can also paste it into the JS console in the dev tools (minus the javascript: at the beginning). Still doesn't work for HTTPS enabled sites.

j-bos 4y ago

Iirc that's a safety feature to tech unsavy users from executing copy pasted code in the url bar. You'll need to manually type javascript: at the beginning. Same applies to chrome.

Reason077 4y ago
I couldn't get it to work (with random web pages) in Safari. Trying to paste it to the URL bar gives the error: "Safari doesn’t allow JavaScript from the Smart Search Field. To allow this, choose “Allow JavaScript from Smart Search Field” from the Develop menu." But even after enabling that option, it still doesn't work. Javascript console shows the errors: [Error] Refused to load http://kathack.com/js/kh.js because it does not appear in the script-src directive of the Content Security Policy. [Error] Refused to load http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js because it does not appear in the script-src directive of the Content Security Policy.
- j-bos 4y ago
  Hmm, I ran into the same issue (without the notification) on chrome and firefox for android..
  - j-bos 4y ago
    Seems the issue is the request being fired off to get the actual script (xss concerns?), my guess is that it would work by copying the requested script into the js url string, rather than requestimg it.
- aendruk 4y ago
  Content Security Policy is a way for websites to ask the browser to disable certain functionality that the website expects to not need. That website evidently has asked the browser to not run arbitrary third-party (or non-https?) scripts. Ideally your browser would recognize that you, the human operator, have authority to override the requests of strangers on your own computer. Sadly, the days of your user agent actually acting on your behalf are waning.
- 4y ago