Wappalyzer: Bookmarklet doesn’t work on facebook.com

[kamillopata]

In developer console there is error:

Refused to load https://wappalyzer.com/bookmarklet/wappalyzer.js because it does not appear in the script-src directive of the Content Security Policy.

There is a possibility to make bookmarklet work on facebook eg. https://utm.plus

[AlexByte]

Its's utm.plus bookmarklet doesn't loading scripts.
@AliasIO What do you think about creating wappaluzer objects using jsonparse of scripts loaded using xhr instead of using script element?

[AliasIO]

How would that work?

[kamillopata]

You can open child window that can load scripts, but i am not sure how you
detect all software stack (of it still works for you in that case)
On Sat, 29 Apr 2017 at 03:28, Elbert Alias [e-mail] wrote:

How would that work?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/AliasIO/Wappalyzer/issues/1533#issuecomment-298138607,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ACo9t5Ue7HxM-iV4grXfLBKgSpvorIg9ks5r0pJPgaJpZM4NF0b4
.

>

cheers!

Kamil Łopata
[phone]
tweets at @KamilLopata https://twitter.com/kamillopata

join the next Open Coffee here http://bit.ly/1NJzGDj!

[AliasIO]

Wappalyzer needs to run in the context of the page, it looks for JavaScript variables to identify applications.

[AlexByte]

Creating wappalyzer objects using jsonparse of scripts loaded using xhr instead of using script element?

I did not take into consideration the directive
connect-src *.facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm.

[AlexByte]

@AliasIO Please create variant of bookmarklet containing all required css and js files, without icons. So you can see the names of technologies on sites that use CSP.

[AliasIO]

I don't think that will work as there is a ~2,000 character limit. It also means updates to app.json won't be rolled out automatically.

[AlexByte]

Actually the limit us much more. It can be separate advanced of bookmarklet.
https://jsfiddle.net/feb7v329/
The limit of size of bookmark adress in Firefox is 65 536.
Limit on the size of a normally running bookmarklet in Chrome is Math.pow(2, 21) (2 097 152) – info.
So such bookmarklet will work in Chrome.

[vaidas-lungis]

Duplicate of https://github.com/AliasIO/Wappalyzer/issues/1580

[AlexByte]

@vaidas-lungis This is not a duplicate.

[q--]

This applies to any site with a restrictive CSP, including, for example, GitHub.

[gadcam]

I think the better is to implement this workaround for Facebook : https://stackoverflow.com/a/25224109/1906722
And then we should close it as it is a Chrome & Firefox bug. (see https://bugs.chromium.org/p/chromium/issues/detail?id=233903 & https://bugzilla.mozilla.org/show_bug.cgi?id=866522)
If you want to dig into this issue I recommend these links :
https://github.com/blog/1477-content-security-policy
https://www.bountysource.com/issues/3561287-bookmarklet-and-csp
https://niutech.github.io/topnewsfeed/
https://stackoverflow.com/questions/7607605/does-content-security-policy-block-bookmarklets/25224109#25224109

[jvoisin]

I'm not a big fan of circumventing security measures, especially with ugly hacks, such as javascript injection in a css file. I would prefer to wait until this is properly supported in browsers (even if it means adding links to the firefox/chrome/IE/lynx/… trackers).

[AlexByte]

@gadcam it's not a bug, but a design 😊

[gadcam]

@jvoisin then we should just close this issue.
Chrome : https://bugs.chromium.org/p/chromium/issues/detail?id=233903
Firefox : https://bugzilla.mozilla.org/show_bug.cgi?id=866522
Edge : https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/11320212/

[jvoisin]

We just have to add a warning in the documentation linking those issues before closing it, in order to reduce the number of people that will open new issues on this tracker about how broken the bookmarklet is, and how dreadful this project is because it used to work before.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.