4 ms·

Fun fact, I found, mostly by accident, that adding a comment to the beginning of a bookmarklet Chrome will set it to the name. I'd love to see the source code i

Fun fact, I found, mostly by accident, that adding a comment to the beginning of a bookmarklet Chrome will set it to the name. I'd love to see the source code in Chrome that does this. Eg javascript:/* name: /awesome# */alert(2+2)

deleted 3y ago
[deleted]
davchana 3y ago
Does it have to be two lines? Going to try this from home.
- gabrielsroka 3y ago
  2 lines?
  - davchana 3y ago
    Edit: my bad, it was my mobile layout. I mean does it need a line break as it is seen in your code?
    - gabrielsroka 3y ago
      I don't see a line break. Are you on mobile? Turn it sideways.
cxr 3y ago
What does "adding a comment to the beginning of a bookmarklet Chrome will set it to the name" mean, exactly?
- gabrielsroka 3y ago
  This is a comment in JavaScript: /* comment */ Bookmarklets, like bookmarks, also have names. I didn't phrase it very well but I figured people would just drag and drop it in Chrome and see it for themselves.
  - cxr 3y ago
    I'm not having trouble understanding the JS part ("a comment [at] the beginning of a bookmarklet"). It's the last part—understanding what it is that you're saying it's actually supposed to do ("will set it to the name") and what that would mean for bookmarklet usage that's giving me trouble. > I didn't phrase it very well but I figured people would just drag and drop it in Chrome and see it for themselves. I did. I spent way too long (15+ minutes) doing that, trying variations of the bookmarklet and user interactions to see if doing so would cause some observable difference and reveal some insight, and trying on different plausible (and implausible) interpretations of your comment.
    - gabrielsroka 3y ago
      Sorry about that. Which OS? It works for me on Windows. When I drag and drop this to the Chrome bookmark bar, it will create a new bookmarklet with the name "awesome" javascript:/* name: /awesome# */alert(2+2) It doesn't seem to work on Chromium on Ubuntu. I don't have a Mac to try it on, perhaps someone else can try it.
      - cxr 3y ago
        Doesn't work on ChromeOS or Ubuntu.
arshxyz 3y ago
Unable to reproduce this on Chrome 118. I just ended up with an untitled bookmark. Still interesting to look at Chromium's source to see that they have unit tests for bookmarklets [1]. Also looks like people "frequently" report running JS from bookmarks as an XSS vulnerability [2] [1] https://github.com/chromium/chromium/blob/0acce829e996f8387c0bd160eaeaf29054e93d27/content/browser/renderer_host/render_view_host_unittest.cc#L157 https://github.com/chromium/chromium/blob/0acce829e996f8387c... [2] https://github.com/chromium/chromium/blob/0acce829e996f8387c0bd160eaeaf29054e93d27/docs/security/faq.md?plain=1#L420-L424 https://github.com/chromium/chromium/blob/0acce829e996f8387c...
- gabrielsroka 3y ago
  Did you drag and drop it? Which OS? It works for me on Windows.
  - gabrielsroka 3y ago
    It doesn't seem to work on Chromium on Ubuntu. I don't have a Mac to try it on, perhaps someone else can try it.
    - arshxyz 3y ago
      Doesn't work on macOS for me. Huh.

deleted 3y ago

[deleted]

davchana 3y ago

Does it have to be two lines? Going to try this from home.

gabrielsroka 3y ago
2 lines?
- davchana 3y ago
  Edit: my bad, it was my mobile layout. I mean does it need a line break as it is seen in your code?
  - gabrielsroka 3y ago
    I don't see a line break. Are you on mobile? Turn it sideways.

cxr 3y ago

What does "adding a comment to the beginning of a bookmarklet Chrome will set it to the name" mean, exactly?

gabrielsroka 3y ago
This is a comment in JavaScript: /* comment */ Bookmarklets, like bookmarks, also have names. I didn't phrase it very well but I figured people would just drag and drop it in Chrome and see it for themselves.
- cxr 3y ago
  I'm not having trouble understanding the JS part ("a comment [at] the beginning of a bookmarklet"). It's the last part—understanding what it is that you're saying it's actually supposed to do ("will set it to the name") and what that would mean for bookmarklet usage that's giving me trouble. > I didn't phrase it very well but I figured people would just drag and drop it in Chrome and see it for themselves. I did. I spent way too long (15+ minutes) doing that, trying variations of the bookmarklet and user interactions to see if doing so would cause some observable difference and reveal some insight, and trying on different plausible (and implausible) interpretations of your comment.
  - gabrielsroka 3y ago
    Sorry about that. Which OS? It works for me on Windows. When I drag and drop this to the Chrome bookmark bar, it will create a new bookmarklet with the name "awesome" javascript:/* name: /awesome# */alert(2+2) It doesn't seem to work on Chromium on Ubuntu. I don't have a Mac to try it on, perhaps someone else can try it.
    - cxr 3y ago
      Doesn't work on ChromeOS or Ubuntu.

arshxyz 3y ago

Unable to reproduce this on Chrome 118. I just ended up with an untitled bookmark. Still interesting to look at Chromium's source to see that they have unit tests for bookmarklets [1]. Also looks like people "frequently" report running JS from bookmarks as an XSS vulnerability [2] [1] https://github.com/chromium/chromium/blob/0acce829e996f8387c0bd160eaeaf29054e93d27/content/browser/renderer_host/render_view_host_unittest.cc#L157 https://github.com/chromium/chromium/blob/0acce829e996f8387c... [2] https://github.com/chromium/chromium/blob/0acce829e996f8387c0bd160eaeaf29054e93d27/docs/security/faq.md?plain=1#L420-L424 https://github.com/chromium/chromium/blob/0acce829e996f8387c...

gabrielsroka 3y ago
Did you drag and drop it? Which OS? It works for me on Windows.
- gabrielsroka 3y ago
  It doesn't seem to work on Chromium on Ubuntu. I don't have a Mac to try it on, perhaps someone else can try it.
  - arshxyz 3y ago
    Doesn't work on macOS for me. Huh.