title: Javascript bookmarklet on site with CSP in Firefox
body: <p>I have a simple Javascript bookmarklet that I put together to run the contents of an appropriate GitHub repository against an external tool:</p>
  
  <pre><code>javascript:(function(){ 
      var isApex = false;
      var sourceLangs = document.getElementsByClassName('lang');
          for (var i = 0; i &lt; sourceLangs.length; ++i) {
          var l = sourceLangs[i]; 
          if(l.innerHTML == 'Apex') {
              isApex = true;
              // alert('This is an Apex repo');
          }
      }
      if(location.hostname != 'github.com' || isApex == false) {
          alert('This is not a GitHub Apex repository!');
      }
      else {
           window.open('https://githubsfdeploy.herokuapp.com/app/githubdeploy'+location.pathname);
      }
  
  })();
  </code></pre>
  
  <p>When I run it in Chrome or IE (after running it through Daring Fireball's JS bookmarklet builder, it works fine. In Firefox, it generates Content Security Policy errors:</p>
  
  <pre><code>[15:33:19.318] Content Security Policy: Directive inline script base restriction violated @ https://github.com/Groundwire/Campaign-Combiner
  </code></pre>
  
  <p>I've read <a href="https://stackoverflow.com/questions/7607605/does-content-security-policy-block-bookmarklets">this SE question on the topic</a>, and the <a href="https://github.com/blog/1477-content-security-policy" rel="nofollow noreferrer">github blog post about CSP</a>, which acknowledges that CSP shouldn't interfere with bookmarklets, but at that time (April 2013), "none of the browsers get this correct." Is it currently the case that Firefox still gets this wrong, but Chrome &amp; IE do? </p>
  
  <p>I also found a blog post about user scripts &amp; CSP, and there the author was able to deal with the issue by including the code from a github repo. I tried that, modifying my bookmarklet to: </p>
  
  <pre><code>javascript:document.body.appendChild(document.createElement("script")).src="https://raw.github.com/tet3/GitHubInstallerBookmarklet/master/GHIBkmarklet.js";void(0)
  </code></pre>
  
  <p>But unsurprisingly, that didn't work for a bookmarklet, as the calling code is still coming from the browser.</p>
  
  <p>In short - any ideas on how to get this bookmarklet to work on Firefox?</p>