3 ms·
No, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.
by oefrha 4y ago
No, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.
- vbezhenar 4y agoYou still can just write your userscript as an extension. I just checked - it works. I inserted script into HN and did some stuff.
- oefrha 4y agoI never said you can’t.
- mh- 4y agoSince one of the parent comments mentioned AJAX, I'll add that you'll also be prevented from eval'ing that payload.
- oefrha 4y agoYes, I should have been more clear: CSP doesn’t allow you to download an external script and execute it, which requires unsafe-eval.
- vbezhenar 4y agoCan you pass data between script and extension? Implementing JS or lua should be possible.
- horsawlarway 4y agoYes - I have done this in an MV3 extension. You can basically re-implement your own runtime and download the code and run it there instead of using eval/script tags. It's very inefficient and it's a pain to write, but it is possible. I suspect they will not approve extensions that do this if it becomes popular.