duckduckgo/content-scope-scripts

Script sources set using setAttributeNS(null, 'src', <url>) are ignored

mattheww-skyward opened this issue · 2 comments

mattheww-skyward commented

For example, the following will try to load a script from https://<hostname>/undefined rather than log.js:

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.3/jquery.js"></script>
        <script>
$(() => {
  var s = document.createElement("script");
  s.setAttributeNS(null, "src", "log.js"); // log.js just calls console.log("ok") to prove it's working
  document.body.appendChild(s);
});
        </script>
    </head>
    <body>
    </body>
</html>

Skyward Qmlativ sites use setAttributeNS when cloning scripts, which breaks a lot of pages. It's easy to work around by checking for the null namespace and calling setAttribute(), but I wanted to make sure you knew about it as well.

jonathanKingston commented

Thanks for the report!
I've opened up #471 to tackle this issue.
If you have some example sites that are broken let me know 😄

mattheww-skyward commented

I don't know of any sites that would be accessible without a login, sorry! However, I can confirm that it works when building from main. Thanks so much!