userscripts icon indicating copy to clipboard operation
userscripts copied to clipboard

`GM.addStyle` not injecting into sub-iframes

Open ACTCD opened this issue 1 year ago • 1 comments

  • https://github.com/quoid/userscripts/issues/268

It seems that in the previous resolution of related issues, only the .css file injection path was changed, but not the GM.addStyle API, which has been using tabs.insertCSS() until now.

But since allFrames, frameId is not supported by Safari, in fact we just inject it into the top frame instead of the corresponding sub-frame.

Methods using the <style> element may be blocked by CSP, and in fact there may still be no way to inject into sub-frame in this case.

The best solution at the moment is probably:

  • If it is top frame, use the tabs.insertCSS() to inject

  • If it is sub frame, use the <style> element to inject it

    • If blocked by CSP, fails and logs in console

The .css file and GM.addStyle API should share the same injection path, but the .css feature will be deprecated (#711) in favor of GM.addStyle in the future.

ACTCD avatar Nov 16 '24 00:11 ACTCD

Some updates

According to my testing, cssOrigin, allFrames actually work in the latest Safari (but not sure from which version it is supported, and apparently Apple hasn't updated their documentation).

frameId is still not supported due to: https://bugs.webkit.org/show_bug.cgi?id=262491


Where allFrames is supported, we may have a workaround to support injecting sub-frames.

That is, add a random class-name to the root node of sub-frame and append it to the user-style. In this way, even if we inject the user-style into allFrames, only the corresponding sub-frame will take effect.

Adding a class-name to an element is not subject to CSP rules, so in principle this should be able to inject a specific sub-frame without being affected by the site's CSP rules.

ACTCD avatar Nov 18 '24 01:11 ACTCD