Can make a userscript to emulate StopTheScript or NoScript?

[waynebloss]

I'm looking for a way to emulate the StopTheScript extension using quoid/userscripts.

In that article, Jeff mentions that in order for StopTheScript to work, the extension must run at document_start and according to the manifest here, Userscripts does run during that event.

However, he says:

If StopTheScript had to wait for settings to be fetched from storage, then it might be too late to stop the JavaScript from running already! Thus, StopTheScript has to do its "magic" at the very beginning of the document load, even before elements of the are loaded.

So, I'm not sure that this is possible via quoid/userscripts because I'm not sure how I can write a script that runs before the document has even been loaded.

It's probably impossible, right?

[quoid]

It's probably impossible, right?

Most likely, yes. This extension needs to do "a lot" of prep work to get all the files and code ready. It's in the ms range but because of that it usually doesn't fire immediately (just like the quote you pasted suggests).

However, you could "easily" block external .js resources, just like the author of StopTheScript says:

Safari content blockers can only block the first type of script. StopTheScript blocks both.

This extension can also create dynamic content blockers by using the declarativeNetRequest API. A "DNR" userscript looks like this:

// ==UserScript==
// @name        Reddit Redirect
// @description Redirects all Reddit requests to the old version of the website
// @run-at request
// ==/UserScript==

{
    "id": 6,
    "priority": 1,
    "action": {
        "type": "redirect",
        "redirect": {
            "transform": { "scheme": "https", "host": "old.reddit.com" }
        }
    },
    "condition": { "urlFilter": "||www.reddit.com", "resourceTypes": ["main_frame"] }
}

You'd have to read through the documentation to figure out how to block all/some js resources. Obviously this is only half of what you are after....

[ACTCD]

I don't know how that works, but some inline scripts are hard to block. For example:

<script>window.location="https://example.net"</script>

This API cannot be overridden. Even if you can do something before the document loads.

Also, in this extension we have to use a lot of asynchronous functions to handle some processes, so we can't inject the script early enough, which has always been an issue we want to solve.

• Investigate Faster Injection #184
• Early JavaScript code cannot be intercepted even with "@run-at document-start", "Instant" injection mode needed #459

[ACTCD]

One possibility way is to exploit the CSP policy in reverse.

The CSP policy can be in response headers or meta elements.
The former seems to be still unmodifiable in Safari, and with the latter, you may need to ensure early injection.