FF57 Userscripts no longer work w/ uMatrix NoScript blocking

[biriss]

I've been testing Firefox 57 and trying to get things working close to the way I had my browser set up before, but I've noticed I can't get Userscripts to run while 1st party site scripts are blocked by either uMatrix or NoScript (using one at a time with the other disabled).

Previously in earlier versions of Firefox, I could browse most sites with NoScript blocking all javascript and Userscripts would still load and run properly. I have just now tested and re-confirmed this on Firefox 55.0.3 with Greasemonkey 3.17 and NoScript 5.17.

On Firefox 57, I have moved over to Violentmonkey 2.8.20 though I also tested with the same results in Tampermonkey 4.5.5590. With either uMatrix 1.1.12 or NoScript 10.1.3c1 set to block all scripts including 1st party site scripts, my Userscripts don't run.

Does anyone have a working configuration to get Violentmonkey or Tampermonkey to run Userscripts when javascript is otherwise blocked by uMatrix or NoScript in Firefox 57? Or is there some way to add an exception to uMatrix or NoScript to only allow Userscripts or change the execution order, so the Userscript processes the page before the script blocker subsequently blocks other script functions?

Or is this a side effect of the new architecture, web extensions and security policy that it's no longer possible to run injected Userscripts when javascript is otherwise disabled?

Has anyone else run into this issue or found a working solution? I'm wondering if I missed something else or new Firefox 57 settings in about:config that need to be configured to make this work.

A basic Userscript test to see if the script loads with/without javascript disabled:

Code: Select all

// ==UserScript==
// @name Hello Console Test
// @namespace Test Script
// @match *://*/*
// @grant none
// ==/UserScript==
console.log("Userscript test: hello console");

[therube]

Ha! How do you like that.
Bookmarklets won't work unless you allow the site - with NoScript 10.x installed.
That really sucks.

Code: Select all

javascript:alert("Hello, World!");

NoScript: Bookmarklets Don't Work unless Site is Allowed

[biriss]

Ha! How do you like that.
Bookmarklets won't work unless you allow the site - with NoScript 10.x installed.

Well, thanks for confirming the issue. I hope we'll see a future update that allows script addons to run without having to allow site scripts.

[biriss]

I just came across this addon which adds a context menu to run bookmarklets even with scripts blocked. I did a quick test with your "hello world" and the bookmarklet worked from the context menu even with NoScript or uMatrix blocking site scripts, although it still didn't run when clicked on the bookmarks bar.

https://addons.mozilla.org/en-US/firefo ... text-menu/

I'm not sure how it works, but I wonder if a similar method could be implemented in Violentmenokey, Tampermonkey or Greasemonkey to allow userscripts to work again while blocking all site scripts.

[biriss]

Since my original post, I've found more awareness and ongoing discussion of the issue, but no 100% working solutions. In Firefox 57, the Content Security Policy (CSP) seems to block most userscripts (with Violentmonkey or Tampermonkey) when other addons are used to block scripts on the site (NoScript, uMatrix, uBlock Origin). However, I've found that a few of my scripts will work when only blocking scripts with uBlock Origin rather than uMatrix (allowing 1st party scripts in uMatrix), but most still do not work.

According to some discussions on the topic, it sounds like Firefox 58 and 59 may have changes to the CSP allow userscripts to run while other scripts are blocked. I'll wait for the final release to give it a try.

I'm also now running Waterfox alongside Quantum for times when I need to run older addons missing or broken in FF57+. Everything seems to work fine in Waterfox so far, just like the old Firefox.

[Brummelchen]

CSP is a server side protection, there is only few you can do. eg addons.mozilla.org is CSP protected thats why addons wont work there.

[Grumpus]

noscript.forbidBookmarklets is a boolean seting (true or False) in about config, see how it's set. May affect bookmarklets.