Scriptlets icon indicating copy to clipboard operation
Scriptlets copied to clipboard

Improve 'trusted-replace-node-text' — add 'trustedTypes.createPolicy'

Open AdamWr opened this issue 1 year ago • 0 comments

It's similar issue like - https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2980 On websites which use a Trusted Types, trusted-replace-node-text doesn't work.

Steps to reproduce:

  1. Add this rule:
youtube.com#%#//scriptlet('trusted-replace-node-text', 'script', 'if (window.ytcsi) {ytcsi', 'if (window.ytcsi) {ytcsi', 'debugger; alert(1);if (window.ytcsi) {ytcsi')
  1. Go to - https://www.youtube.com/

Alert message should be displayed but modifying a script is blocked by Trusted Types.

Screenshot

image

Adding trustedTypes.createPolicy to scriptlet probably should fixes it.

Issue occurs in Chromium based browsers but doesn't occur in Firefox because it doesn't support Trusted Types API.

AdamWr avatar Oct 04 '24 16:10 AdamWr