-
Notifications
You must be signed in to change notification settings - Fork 160
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Nonce or hash neded for inline JS execution with Shortkeys #599
Comments
Same here, been having this issue since yesterday :( |
See #598 - the upgrade had issues. I'm waiting for the webstore team to approve my reverted package which should get you back in working order. |
Thank you Mike |
Well, this came back after last Chrome update :( |
Playing around with a few potential solutions to this, and it looks like this API is what's needed to fix this: https://developer.chrome.com/docs/extensions/reference/api/userScripts It will require a bit of a refactor, but it looks viable. I can try this out and possibly submit a PR if successful. |
Ok, here's what I've come up with so far. When the shortcut keys are updated, a userscript is registered that contains all the handlers and a snippet to listen to the Here is an example of a generated userscript: const handlers = {"shift+a":function() {console.log("hello2")},};
function registerHandlers() {
document.addEventListener('shortkeys_js_run', function (e) {
if (handlers[e.detail]) {
handlers[e.detail]();
}
});
}
registerHandlers(); Here is the branch I've made an MVP implementation in. It's very messy and there are lots of areas of improvement (in addition to the messaging to the user that they need to enable developer mode for JS to work now), but I'm just looking for feedback on the general concept. If the maintainers are good with this strategy, I can clean it up and get this merged, or y'all can take it over from here. Whatever works best! |
@tjhorner could you provide built .zip? I don't have an option to build it myself right now. I use gmail extensively with shortkeys and will provide feedback. Thanks |
This issue probably manifests with the following error |
Also, as someone mentioned above, the TrustedScript is an issue that cropped up after a recent update from the webstore. I had to accept new permissions and was told Shortkeys was going to run in the background, just like when the first broken release came out. Could perhaps the webstore have put back out the broken version? |
I reverted back to version 4.0.3 and it is working for the time being. |
any updates on this? still seems broken on firefox |
Is there an update on this? I am also getting this error:
|
I have a working fix, I'm just waiting for the maintainers to provide feedback. If they are unresponsive I can publish a version of the extension myself as well |
Apologies for the wild delay @tjhorner! I'm attempting to catch up on issues now. Your approach looks great! If you want to clean it up and PR it, I'd be happy to review/accept. |
It's all good @crittermike! I'll go ahead and make the PR sometime this weekend. |
Hi,
I am using Shortkeys with Dropbox to grab files path from browser address bar. Since yesterday it doesn't work - console echoes after pressing shortcut: "Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' https://www.dropbox.com/static/api/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js 'nonce-My20cdvnPoIjcndfFw9sYH7gvs8='". Either the 'unsafe-inline' keyword, a hash ('sha256-TecPFdRXpOdzuusl+jgCFoR6XHmyaC+ihkUUj+LCIbc='), or a nonce ('nonce-...') is required to enable inline execution".
Is there anything that can be done?
The text was updated successfully, but these errors were encountered: