Feature Request Is your feature request related to a probl

I pushed a Java change that should fix inclusion of tags. <p dir="aut

Great! The external Java sources of my Matomo demo are now injected in the HTML

I changed the API a bit from my initial idea: <a href="https://github.com/dmind-gmbh/e

[FEATURE] Allow adding external scripts (affects strict Content Security Policy) about extension-cookieman HOT 5 CLOSED

dmind-gmbh commented on June 15, 2024

[FEATURE] Allow adding external scripts (affects strict Content Security Policy)

from extension-cookieman.

Comments (5)

commented on June 15, 2024

Good point, we did not test with restrictive CSP yet. Thank you for bringing that up. Of course we need to support that.

Current situation
We have some voodoo for <script>s in place:

we let a new DOM-object parse the HTML from the inject setting
with any <script> in there (which will be inactive due to being inserted with .innerHTML) we extract it and add it one by one (to the end of the <body>)

Here's the relevant section

extension-cookieman/Resources/Public/Js/cookieman.js

Lines 99 to 124 in 0ea02dc

 function injectTrackingObject(trackingObjectId, trackingObjectSettings) { 

 if (typeof trackingObjectSettings.inject !== "undefined") { 

 // <script>s inserted via innerHTML won't be executed 

 // https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML 

 // Let the DOM parse our inject-HTML... 

 var pseudo = document.createElement('span') 

 pseudo.innerHTML = trackingObjectSettings.inject 

 // ...and insert <script>s manually 

 var pseudoScripts = pseudo.querySelectorAll('script'), 

 _script 

 for (var _i = 0; _i < pseudoScripts.length; _i++) { 

 _script = document.createElement('script') 

 _script.textContent = pseudoScripts[_i].textContent 

 document.body.appendChild(_script) 

 pseudo.removeChild(pseudoScripts[_i]) // remove from pseudo 

 } 

 // append the rest of pseudo 

 document.body.appendChild(pseudo) 

 // keep track what we injected 

 injectedTrackingObjects.push(trackingObjectId) 

 } 

 }

Found a problem
I think I just forgot to copy all of the <script>'s attributes to the newly inserted one! So e.g. any src= would not be transferred!
If we do that correctly, I feel we should be ok as we would do then exactly as many tracking objects inject itself:

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

Tests
I'd like to add that also to the automated tests.
Are you using Content-Security-Policy: script-src 'self'?
Thing is that this also affects the example themes: you cannot use onclick=... with that ;)

reSt docs
Oh, I would be very happy to have the docs .rst'ed and would gladly switch to it:) I just don't have any experience with it yet and feared that our multi-branch-approach would be a bit difiicult to set up with https://docs.typo3.org/ - it would be great if you could get us started with that. Thank you, Sebastian!

from extension-cookieman.

commented on June 15, 2024

I pushed a JavaScript change that should fix inclusion of script tags.

Could you please review this change in cookieman[.min].js?

b595ae1

from extension-cookieman.

sebkln commented on June 15, 2024

Great! The external JavaScript sources of my Matomo demo are now injected in the HTML and recognized.

On some pages I now get error messages in the browser console that _paq.push() was used but Matomo tracker was not initialized before the matomo.js file was loaded. But this is a different issue that needs to be fixed by myself.

from extension-cookieman.

commented on June 15, 2024

On some pages I now get error messages in the browser console that _paq.push() was used but Matomo tracker was not initialized before the matomo.js file was loaded. But this is a different issue that needs to be fixed by myself.

Normally you would attach a function to the script like <script onload="callAllPaq_s()"...> but as I just learned inline JavaScript wouldn't work with CSP: script-src.
It would be nice if cookieman could provide an event so that you could do:

cookieman.TrackingObjects.Matomo.injects.scripts[0].onload = function() { _pag.push() }

That would be possible and not too hard to implement.

from extension-cookieman.

commented on June 15, 2024

I changed the API a bit from my initial idea: https://github.com/dmind-gmbh/extension-cookieman#cookiemanonscriptloadedstring-trackingobjectkey-int-scriptid-function-callback-void

Does that fit your use case?

from extension-cookieman.

[FEATURE] Allow adding external scripts (affects strict Content Security Policy) about extension-cookieman HOT 5 CLOSED

Comments (5)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Jobs

	function injectTrackingObject(trackingObjectId, trackingObjectSettings) {
	if (typeof trackingObjectSettings.inject !== "undefined") {
	// <script>s inserted via innerHTML won't be executed
	// https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML

	// Let the DOM parse our inject-HTML...
	var pseudo = document.createElement('span')
	pseudo.innerHTML = trackingObjectSettings.inject

	// ...and insert <script>s manually
	var pseudoScripts = pseudo.querySelectorAll('script'),
	_script
	for (var _i = 0; _i < pseudoScripts.length; _i++) {
	_script = document.createElement('script')
	_script.textContent = pseudoScripts[_i].textContent
	document.body.appendChild(_script)
	pseudo.removeChild(pseudoScripts[_i]) // remove from pseudo
	}

	// append the rest of pseudo
	document.body.appendChild(pseudo)

	// keep track what we injected
	injectedTrackingObjects.push(trackingObjectId)
	}
	}