alert-buster.js doesn't work on Firefox

[theel0ja]

Prerequisites

• I verified that this is not a filter issue (MUST be reported at filter issue tracker)
• This is not a support issue or a question
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
• The issue is not present after wholly disabling uBlock Origin ("uBO") in the browser
• I checked the documentation to understand that the issue I report is not a normal behavior

I tried to reproduce the issue when...

• uBO is the only extension
• uBO with default lists/settings
• using a new, unmodified browser profile

Description

alert-buster.js doesn't work on Firefox, while it works on Chromium.

A specific URL where the issue occurs

https://ylilauta.org/

Steps to Reproduce

1. Install uBlock Origin on Firefox
2. Enable Finnish Easylist Additions, which has a rule for ylilauta.org
3. Get alerts on ylilauta.org even when alert-buster.js should be activated

Expected behavior

No alerts, logged into console. Works correctly on Chromium (tested with uBO 1.41.8 on Chromium 100.0.4896.62)

Actual behavior

Alerts are still shown, like seen in the picture in the "Description"

uBlock Origin version

1.42.0

Browser name and version

Tested on Firefox 98.0.2 and 99.0b8 (DevEdition)

Operating System and version

macOS 12.3.1

[gorhill]

Unable to reproduce an alert in the first place. You will have to provide details on how to trigger this alert.

---

Never mind, I get the alert when enabling FIN list.

[gorhill]

The issue is that the CSP for the page prevent inline scripts from being injected:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).

Firefox's behavior differs from Chromium here.

[gorhill]

Duplicate of #235.

https://bugzilla.mozilla.org/show_bug.cgi?id=1267027

[krystian3w]

For my side Tampermkoney disable most CSP with almost empty script in expert mode.

In that way I can still use:

• google toolbar to translate pages,
• $cps and $inline-script filtering.

So works better than security.csp.enable (no longer works - see https://bugzil.la/1754301 - removed im 99+ releases) and I guess better than scriptlet doctor (this still don't help load Google resources).

[Cerberus-tm]

For my side Tampermkoney disable most CSP with almost empty script in expert mode.

Hey, this sounds highly useful, how do you do this, or what should there be in the Tampermonkey script?

This works in Firefox?

[MasterKia]

@Cerberus-tm Install Scriptlet Doctor:
https://github.com/JustOff/scriptlet-doctor/releases/download/1.2.5/scriptlet-doctor-quantum-1.2.5.xpi

Don't forget to disable "Limit to domains".

[Cerberus-tm]

@Cerberus-tm Install Scriptlet Doctor: https://github.com/JustOff/scriptlet-doctor/releases/download/1.2.5/scriptlet-doctor-quantum-1.2.5.xpi

Don't forget to disable "Limit to domains".

Hey, thanks, I was going to try Scriptlet Doctor too, though it won't download at the moment.

But I was also curious about the solution using Tampermonkey.