I have a bookmarklet. When the user clicks the bookmarklet, it inserts a tiny snippet of code. This code inserts a script element, which in turn gets the actual script that does the work.
This works on most websites, but some websites block scripts via their content-security-policy. For example, they might have
content-security-policy: script-src 'self'
However, there are some websites where the script is blocked, but I can't see what policy is blocking it. One case is bbc.co.uk, for example https://www.bbc.co.uk/food/recipes/korean-style_mapo_tofu_50944
In the developer tools Network tab, it says that myscript.js is
blocked(csp)
However, I do not see the csp policy of this page like I do for other websites that block the script.
What is blocking the script request?
Here is the full bookmarklet code. myscript.js is replaced with a generic library so others can test.
javascript:(function(){var s=document.createElement('script');s.setAttribute('src','https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?'+new Date().getTime());document.getElementsByTagName('body')[0].appendChild(s);})();
Prettier:
javascript:(function(){
var s=document.createElement('script');
s.setAttribute('src','https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?'+new Date().getTime());
document.getElementsByTagName('body')[0].appendChild(s);
})();
The date parameter is just to prevent the webpage using a cached version.
