Permalink
Browse files

Inject bookmarklets by appending them as scripts.

This *should* fix the permission problems that `eval` faced.

Closes #575, #710.
  • Loading branch information...
1 parent 386a3cf commit a3eb1cbee93c4c10505f629b8bc8bc00e37adb8a @int3 int3 committed Nov 10, 2012
Showing with 3 additions and 1 deletion.
  1. +3 −1 content_scripts/vomnibar.coffee
View
4 content_scripts/vomnibar.coffee
@@ -213,7 +213,9 @@ extend BackgroundCompleter,
navigateToUrl: (url, openInNewTab) ->
# If the URL is a bookmarklet prefixed with javascript:, we shouldn't open that in a new tab.
if url.startsWith "javascript:"
- eval decodeURIComponent(url["javascript:".length..])
+ script = document.createElement 'script'
+ script.textContent = decodeURIComponent(url["javascript:".length..])
+ (document.head || document.documentElement).appendChild script
else
chrome.extension.sendRequest(
handler: if openInNewTab then "openUrlInNewTab" else "openUrlInCurrentTab"

0 comments on commit a3eb1cb

Please sign in to comment.