Latest Stylus 1.5.38 no longer handles styles for addons.mozilla.org

[ghost]

And may not handle as well styles for other "reserved" domains (haven't tested widely).

Environment : Stylus 1.5.38 / Firefox 115.5.0 ESR / Windows 7

Of course toolkit.legacyUserProfileCustomizations.stylesheets has always been set to true in about:config.
No issues with Stylus 1.5.35 from which I've updated to 1.5.38
At this point I have to remove from my Stylus styles the style pertinent to addons.mozilla.org and add it to my userContent.css file, where it works fine.
Any clue?

[tophf]

I've tested the old version, sorry. I see the bug.

The workaround is to enable Circumvent CSP 'style-­src' via adoptedSty­leSheets in options.

Preliminary investigation indicates the old Stylus miraculously exploited a bug in Firefox and managed to ignore CSP, so if this is indeed so, we won't re-enable the exploit...

[ghost]

OK. Thanks for your quick response.

EDIT : Circumvent CSP 'style-­src' via adoptedSty­leSheets fixes the issue, indeed
If this is an option and not natively enabled then there must be pros and cons. The pros are illustrated with this very issue, but what are the cons?
In other words what does this option handle (Stylus doesn't provide info for that option). I have in mind keeping it enabled once Stylus updated. Why should I, why should I not? Thanks :)

[ghost]

Preliminary investigation indicates the old Stylus miraculously exploited a bug in Firefox and managed to ignore CSP, so if this is indeed so, we won't re-enable the exploit...

Amazing how even a tiny issue at start can end up to true discoveries after investigation :)

[tophf]

I've decided to restore the exploit in db119ba because it matches the intentional behavior in Chrome and Mozilla doesn't want to fix it: https://bugzil.la/1706787.

Regardng adoptedSty­leSheets, it's a new thing and it may be bugged in some cases e.g. theoretically the styles may be removed or re-ordered by another script and we won't detect it due to the lack of an efficient observation/notification method in this API.

[cristian64]

I've been seeing this problem in other sites too (e.g. https://pypi.org on Firefox).

Has it been considered to enable the Circumvent CSP 'style-­src' via adoptedSty­leSheets setting by default? My 50 cents: It seems to me many are going to be hitting this issue, and the solution may not be so obvious for non-web developers.

[tophf]

I guess we can enable it as an automatic fallback in case the CSP blocked the style and show a corresponding warning in the popup...

[tophf]

@Mottie, how about posting a beta in CWS and then release everywhere at the end of the week? Looks like I've just found a way to circumvent CSP entirely in Firefox, which has been bugging more and more users recently as the sites tighten up.

[ghost]

Enable Circumvent CSP 'style-­src' via adoptedSty­leSheets in options prevents the Live preview feature to work. Page needs to be reloaded.
No idea why this thread has been closed. 1.5.38 is problematic and the issue mentioned should remain opened IMO given it is NOT fixed.
Stylus 1.5.38 is just not ready and has been released unfinished.
At this time I will shift styles for problematic sites (those that require Circumvent CSP 'style-­src' via adoptedSty­leSheets) to my userContent.css and disable Circumvent CSP 'style-­src' via adoptedSty­leSheets.

[tophf]

The new 1.5.39 should have fixed it, which is why the issue is closed. If you can't use it as a temporary extension, try using the previous working version 1.5.35. The new version will be released in a week, hopefully.

[ghost]

Previous 1.5.35 has always ran flawlessly. Problem with running older versions than current is that extensions' updates will overdo them if automatic and otherwise forces the user to be aware when updating manually as I do. I run 60+ extensions and several happen to be "updatable" simultaneously.
I've set Stylus back to 1.5.35 to enjoy then reversed to latest 1.5.38, also because besides the drawbacks there must be some hidden improvements, anyway I hope. I'll wait for 1.5.39.
Please don't let me be misunderstood: as many I'm quite fond of Stylus, in my view the best userstyle extension available, at least for Firefox. And I appreciate your work, the team's commitment. But when you like a product you're more annoyed of any issue than when you like it moderately.

[tophf]

I'm not offended, I understand the pain. Unfortunately such bugs are inevitable as no one regularly tests the extension in Firefox since Mozilla removed the support for beta versions from AMO.

[Mottie]

v1.5.39 submitted to CWS & AMO

[tophf]

Wait, there are some trivial fixes since then, so maybe cancel the one on AMO and upload 1.5.40? I'm not sure you can cancel a pending update on CWS though, previously it was impossible, IIRC. @Mottie

[Mottie]

I can't remember either... let's wait until tomorrow