[BUG]Another script (tabThumbnailTooltip.uc.js) stopped working in Firefox nightly 136 due to recent changes in Content Security Policy.

[kaos-55]

Link to the file containing the bug
https://github.com/aminomancer/uc.css.js/blob/master/JS/tabThumbnailTooltip.uc.js

Describe the bug
Annoying again, but another one of the scripts I use has stopped working due to the changes implemented in Nightly 136 regarding the Content Security Policy.

To Reproduce
Steps to reproduce the behavior:

1. Install Firefox nightly 136a1
2. Install tabThumbnailTooltip.uc.js
3. The tab thumbnail does not appear

Expected behavior
The tab thumbnail appears when installing the script.

Screenshots
This is what the browser console displays

Desktop (please complete the following information):

• OS: Winwdos 10
• Firefox update channel: Nightly
• Version: 136.a.1
• Build ID: 20250118

Additional context
It seems that the problem is in line 98 of the script due to a csp violation which blocks the event handlers. Reading in the documentation I found that to avoid that violation you must replace the inline event handlers with addEventListener calls, I tried to fix it by rewriting the line with addEventListener but it didn't work, I don't know how to call MozXULElement.parseXULToFragment with addEventListener and then add it to the DOM using appendChild.

[kaos-55]

After trying a little bit I think I misunderstood and apparently you need to first create the function, in this case MozXULElement.parseXULToFragment and then add it to the DOM, then call that function with addEventListener.
However, I have no idea how to create the new function and even less how to call it with addEventListener.😔

[LakesideMiners]

This issue seems to have spread to ALL scripts.

[aminomancer]

Those are two separate issues. The first is CSP blocking inline script attributes like <button onclick='doSomething(this)'/>, the second is CSP blocking eval() which breaks many script functions. For the first issue, we can just use javascript proper (like button.addEventListener(...)) and for the second, see this bug. It may take a while for this to be fixed, though. I'm looking for a workaround.

[aminomancer]

This issue seems to have spread to ALL scripts.

This should be fixed in the near future, at which point there may be a pref you need to add to enable unsafe-eval in the chrome. But for now, there's a way to restore the old CSP.

1. Go to your Firefox install folder
2. Find the browser folder in there
3. There should be an omni.ja file. Open it in 7-zip file manager
4. In there, navigate to chrome\browser\content\browser\
5. Drag the browser.xhtml file from there to your own profile's chrome folder. If you have any of my stuff installed, you should have a chrome/resources/script-override folder. That's where I put it.
6. Open chrome/utils/chrome.manifest, or wherever your file manifest is. If you don't have one, either get a script manager that has one, like fx-autoconfig, or make one in your profile folder and register it with the config.js file in your Firefox install folder (see fx-autoconfig install instructions).
7. Add this line somewhere in your manifest: override chrome://browser/content/browser.xhtml ../resources/script-override/browser.xhtml (the second argument should be the relative path to wherever you put browser.xhtml in step 5)
8. Open browser.xhtml in a text/code editor, find this line and delete it.
9. Quit Firefox, clear your startup cache folder (in your local profile directory, it can be found through about:profiles), and relaunch Firefox. Things should be working again now.

[LakesideMiners]

yah sorry about that, ment to say it looked like it just, got rid of all the fx-autoconfig stuff from the folders. attempting above fix now

[LakesideMiners]

Still geting the same errors, I have attached a log file below and can provide any other files needed for debugging. the tabBrowser error occurs after resizing the window
console-export-2025-4-7_16-35-44.txt

[aminomancer]

Maybe you didn't do the steps properly. The above steps remove the chrome doc's CSP completely so it's impossible for it to block eval. What version are you on?

[aminomancer]

Oh wait, I forgot to include a step. Sorry.

After step 7, open browser.xhtml in a text/code editor, find this line and delete it. Then do the last step.

[LakesideMiners]

I am unable to find that line in the file. Version i am on is 139.0a1

[aminomancer]

Okay, I only support Nightly FYI. The readme is pretty clear on that. But deleting the meta line in your file should work fine in this case.

[LakesideMiners]

This, is nightly. https://www.mozilla.org/en-US/firefox/139.0a1/releasenotes/ I'l try doing that tomorrow morning and will report back