Bypassing CSP

[cyber-sec0]

Expected Behavior

I can grab a CSS or HTML file containing inline styles or style tags from anywhere, in any manner, and inject it on the page.

Actual Behavior

Script breaks.

Script

// ==UserScript==
// @name               ddd
// @namespace          
// @description        
// @version            74
// @author             
// @include            *
// @grant              GM_getResourceText
// @grant              GM.xmlHttpRequest
// @run-at             document-end
// @connect            *
// @resource           css https://domain.com/cs.css
// ==/UserScript==

//Method 1 using GM_getResourceText

const container = document.createElement('div');

// Attach a Shadow DOM to the container
const shadowRoot = container.attachShadow({ mode: 'open' });

// Create a <style> element and inject the fetched CSS into it
const style = document.createElement('style');
style.textContent = GM_getResourceText("css");  // Inject the CSS content

// Append the style element to the Shadow DOM
shadowRoot.appendChild(style);

// Append the container (with Shadow DOM) to the body
document.body.appendChild(container);



//Method 2 using "fetch"

// Request the external CSS
GM.xmlHttpRequest({
  method: 'GET',
  url: 'https://domain.com/cs.css', // Replace with your CSS URL
  onload: function (response) {
    // Create a container for the Shadow DOM
    const container = document.createElement('div');

    // Attach a Shadow DOM to the container
    const shadowRoot = container.attachShadow({ mode: 'open' });

    // Create a <style> element and inject the fetched CSS into it
    const style = document.createElement('style');
    style.textContent = response.responseText;  // Inject the CSS content

    // Append the style element to the Shadow DOM
    shadowRoot.appendChild(style);

    // Append the container (with Shadow DOM) to the body
    document.body.appendChild(container);
  }
});

Testing page
https://www.icloud.com/shortcuts/7d4712f9ca6e4c60aeb5cf813873dcd3

[derjanb]

What is your Tampermonkey, browser and OS version?

[cyber-sec0]

@derjanb

TM = Latest 5.3.2
Edge = Latest 131.0.2903.63 (Official build) (64-bit)
Win 11 = Latest