CSP injectScript warning

[bravecrayon]

In FireFox 123.0b1 on a site with CSP script-src set to 'self' I see this in the console:

Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). utils.js:42:10

That is this line. Why is it trying to inject a <script> tag? Also, could a site easily evade whatever PrivacyBadger is trying to do here with a specifically crafted CSP?

[ghostwords]

Thanks for reaching out!

This is a bug in Firefox where the browser fails to override site CSPs for page context ("main world") scripts injected by extension content scripts.

This will be fixed when Firefox fixes their bug, or when we will change the way we inject into page contexts.

Privacy Badger injects page context scripts for things like click-to-activate widget placeholders, DNT/GPC signals in JavaScript, and denying JavaScript cookie access to "cookie-blocked" ("yellowlisted") domains. Core tracker blocking functionality is not affected.

Closing as a duplicate of #1793.