I have a bookmarklet in which I attempt to load a script from a remote server, then execute some code after the script loads. A stripped-down example can be seen below:
(function () {
var url = '//ajax.googleapis.com/ajax/libs/jquery/1.9.0/jquery.min.js';
var injectExtensionScript = function (path) {
alert('injectExtensionScript');
var element = document.createElement('script');
element.type = 'text/javascript';
element.src = path;
document.addEventListener('load', function () {
alert('loaded jquery');
}, true);
document.head.appendChild(element);
};
document.head.setAttribute('data-foobar', 123);
injectExtensionScript(url);
})();
(minified for bookmarklet)
javascript:(function()%7B(function%20()%20%7Bvar%20url%20%3D%20'%2F%2Fajax.googleapis.com%2Fajax%2Flibs%2Fjquery%2F1.9.0%2Fjquery.min.js'%3Bvar%20injectExtensionScript%20%3D%20function%20(path)%20%7Balert('injectExtensionScript')%3Bvar%20element%20%3D%20document.createElement('script')%3Belement.type%20%3D%20'text%2Fjavascript'%3Belement.src%20%3D%20path%3Bdocument.addEventListener('load'%2C%20function%20()%20%7Balert('loaded%20jquery')%3B%7D%2C%20true)%3Bdocument.head.appendChild(element)%3B%7D%3Bdocument.head.setAttribute('data-foobar'%2C%20123)%3BinjectExtensionScript(url)%3B%7D)()%7D)()
Adding this bookmarklet to Chrome, Safari and IE the code works as expected -- the "data-foobar" attribute gets added to the document head, and the script loads (and my event listener fires).
However, Firefox is a different story altogether. The script appears to run (no errors, and the first alert()
fires... but the "data-foobar" attribute is not added to the document head, nor is the script ever loaded (network tab never records a request, and event listener never fires).
I don't think this is the same bug as Bug 866522 - Bookmarklets affected by CSP because the sites I'm trying this on are not using a CSP.
Any ideas?
Specs: OSX 10.10.2, Firefox 39. Standard settings, except: * I block popups, * do-not-track, * never remember history, * warn me when sites try to install add-ons * block reported attack sites * block reported web forgeries * NOT set as my default browser * Flash not installed
As it turns out, having the checkbox "Load this bookmark in the sidebar" checked seemed to be the problem. I don't know how that happened.