Add UserJavaScript support

[uahim]

I'm aware this has very low priority, but it would be excellent if it could be added in later versions as UserJS lets the user define how a site works in many cases - not vice versa ;-)

[Emdek]

Not really a low priority, it's quite useful, along user CSS. ;-)
Basic support is not that hard to implement, hardest part is common issue - how to match URLs in most efficient way.

[lollox]

can't we simply rely on grease/violent/tamper-monkey implementation?

[Emdek]

@lollox, nope, and we don't need, it's not that hard to do (except for efficient URL matching, needed by other components anyway).

[Chocimier]

I think that for userjs we don't have to use very efficient matching, qt's wildcards should be enough. It's just a few comparision for every web page open, much less than in adblock.

[Emdek]

@Chocimier, yes, but it would be best to have only one parser and single syntax for all purposes. ;-)

[uahim]

for now, javascript bookmarklets already work :)

[lollox]

http://www.ghacks.net/2014/06/18/greasemonkey-2-0-introduces-changes-may-break-scripts/

seems the new version could introduce incompatibility problems with some scripts... I don't know if this could affect Otter too, so just for your information :)

[Zero3K]

What's the status on implementing this?

[Emdek]

@Zero3K, basic support (loading selected / all scripts every time) isn't a big task, but providing compatibility with existing solutions is harder.
Perhaps I should split this ticket into two, keeping this for basic implementation (well, it will be enough in most cases anyway, I guess) and another one for more advanced stuff (possibly QtWebKit specific).

[uahim]

@Emdek so if possible, add basic support for the time being and let users enable it via basic_userjs true (with default being false) in about:config? :) Otter is better than Vivaldi already, but adding this would make it win the race for now

[Emdek]

@uahim, I don't think that we really need an option for that, for now it should be enough to check if that directory exists.
Perhaps I'll find some time to create basic manager too.

[Emdek]

Here is ticket for tracking work on improved support for GM scripts: #1091.

[pierreporte]

I wrote a comment #832 (comment) in response of @zoidbergthepopularone about a potential user-JS password manager. He said that he disables JS since it is a “huge security hole” and it leads me to an interrogation: could remote JS be disabled while user JS be still enabled? That way, users could still use their userscripts while avoiding JS provided by websites.

Edit: I didn’t post in #1091 since it’s not really about Greasemonkey compatibility. I may be wrong though.

[zoidbergthepopularone]

@pierreporte: 1) From what I have seen, I very much doubt that modern browser engines (at least Chromium, Blink, WebKit and Gecko) support differentiation of the source of a particular script. As an evidence I would like to point out that, to the best of my knowledge, no browser based on the mentioned engines allows a creation of extension which would be able to interact with a webpage AND not require javascript turned on for that webpage. AFAIK, the extension's code gets injected into the webpage and then treated as the webpage's native script. The same is true for e.g. Opera 12's UserJS implementation.

2. Microsoft did very much the same thing in Internet Explorer 4 with the introduction of different security zones. A great number of critical vulnerabilities of IE comes from the fact that a webpage managed to break from the Internet zone to the My Computer zone. I would take that as indication that properly separating sources of scripts would be a difficult challenge.

[The-Compiler]

QtWebEngine allows running JS via runJavaScript with the page having disabled just fine, QtWebKit allows it with a workaround which works fine in all scenarios I could test, but apparently doesn't for some users - see this file for some related tests I've written to verify that.

I'm also pretty sure Chromium extensions run just fine when the JS is disabled for the page.

[ccd0]

I'm also pretty sure Chromium extensions run just fine when the JS is disabled for the page.

They do for the most part, although event handlers registered by the extension don't work. Event handlers from Greasemonkey scripts in Firefox work without JS enabled, though.