GM 4: How do you manually install scripts?

[erosman]

How do you install script not on any server ie manually?
I only use my own scripts and they are not hosted.
After GM4 upgrade, some of the scripts are missing.
How to I add them?

[Owyn]

same question, when I open *.user.js file in browser, nothing happens with GM, it just loads text page normally

[Sxderp]

Assuming you're attempting local install file://. #2612

[erosman]

I was reading that it is NOT possible to import/install scripts in GM 4.0 and the code has not been included in GM 4.0 release.

We have to wait for future updates which is impractical.

[Owyn]

so there is no way now? fix when? 🤔

[Sxderp]

@erosman , @Owyn , I don't quite understand your comments. Are you expecting GM to go out of its way to circumvent Firefox security policy/restrictions?

While I did suggest method, using storage, to work around the issue, in which I had a working implementation, I found it too risky. Unfortunately userscripts, currently, are executed using tabs.executeScript which doesn't completely sandbox them. They inherit many of the permissions of the parent extension. This includes access to the same storage instance. It's too risky to put a script in there and expect it to be the same when it comes out.

Further, I attempted to work the around issue using messaging to a background script. That too had security problems. Messages sent from tabs.executeScript as well as ones sent in scripts registered from the manifest have their origin set to the tab's origin. I couldn't figure out a way to prevent normal scripts from then sending a message and injecting whatever the hell they want.

Perhaps someone smarter than me can figure it out. But it's not super trivial.

--

Now, onto a possible solution for your immediate issue. If you add a script that is hosted from someplace, https://greasyfork.org/en, or equivalent, then you can edit the newly added script and paste your local file contents. Then repeat. You can repeat with the same remote userscript file.

[Owyn]

As users - we simply don't understand the issue, we just want it to work...

If it's about some mysterious malicious scripts, or malicious extensions, or malicious executables, or malicious anything... it was always up to user to not run any untrusted code found on sight, protecting the user not to shoot himself in the leg should not break the expected functionality of the program. So yea.

[Eselce]

@Sxderp I think, these guys would be totally fine with an New Script opening the editor CodeMirror with a (new) empty script, so that you can paste it in the code. No need to send risky data. It's your solution, but without having to install some nonsense script and it should also work with @require and other resources (I can't see a method to change the number of related script resources in the editor CodeMirror).

[Sxderp]

I think, these guys would be totally fine with an New Script opening the editor CodeMirror with a (new) empty script.

This is being worked on, but I think that a stop-gap solution may be necessary. I'm going to look into creating a new script button which creates a new script and opens the editor directly. I'm sure @arantius would like some sort of similar GUI as in 3.x, but for now I think this should be brought forward as a temporary measure.

(I can't see a method to change the number of related script resources in the editor CodeMirror).

If you add new @requires and save the script they should be fetched. Though new tabs won't be created until you refresh the page. Could be worth a separate ticket to sync the tabs on save.

[erosman]

@erosman , @Owyn , I don't quite understand your comments. Are you expecting GM to go out of its way to circumvent Firefox security policy/restrictions?

I have no idea what you are talking about.

Please note .....

• GM 4.0 failed to import all GM 3 scripts
• We want to add the missing scripts (and/or new scripts) by any method which could be:
  • Import script from a local file and that is allowed by Firefox security policy via File input
  • Copy/paste the code into GM 4

These options are not available in GM 4 and hence the impracticality of the status quo.

[arantius]

You can't today, and likely never will be able to install from file:///. Complain to Mozilla, that the new/only extension API does not provide even read access to files. If this ever happens, as mentioned it's tracked in #2612 .

Restoring "new script" is planned.

If you add new @requires and save the script they should be fetched. Though new tabs won't be created until you refresh the page. Could be worth a separate ticket to sync the tabs on save.

Definitely.

[erosman]

You can't today, and likely never will be able to install from file:///.

Of course you can .... I do it in my own WebExtensions. let me know if you need me to explain how to import from file in a WebExtension.

A WebExtension can read a local file using File Input and user action, then save that to its own database.

Complain to Mozilla, that the new/only extension API does not provide even read access to files.

That is is different issue. WebExtension can not read a local file without user interaction but that is NOT what we are talking about. We are talking about import using File Input.

This bug is closed prematurely.

[arantius]

A WebExtension can red a local file using File Input and user action, then save that to its own database.

Please discuss file installation in #2612 .