pdf.js CSP disallows dark mode script?
I have a bookmarklet that inverts the colors of a pdf (and changes the hue back accordingly) in pdf.js by appending a style element. Recently, it stopped working due to a new style-src CSP in pdf.js. Is there any way to change this CSP locally? Or any plans for an actual dark mode in pdf.js? Reading https://bugzilla.mozilla.org/show_bug.cgi?id=866522, it has been a "bug" for 13 years that bookmarklets are affected by CSPs at all.
It seems you can change CSS with a userContent.css file, but I don't see how that could be used to create an "on/off" switch.
เปลี่ยนแปลงโดย asdfghjklöä เมื่อ
การตอบกลับทั้งหมด (1)
asdfghjklöä said
I have a bookmarklet that inverts the colors of a pdf (and changes the hue back accordingly) in pdf.js by appending a style element. Recently, it stopped working due to a new style-src CSP in pdf.js. Is there any way to change this CSP locally?
I think CSP is designed to be read at load time and can't be edited after load, so those restrictions would be difficult to overcome in the built-in viewer.
Or any plans for an actual dark mode in pdf.js?
I think there is dark mode for the bits around the document, but not the document itself. But in an old Github issue, I read that if your system uses High Contrast Dark Mode, then the document will be inverted. Interesting, but I haven't tested because changing themes in Windows can throw everything into disarray and require a reboot.
Assuming that still exists, is there a way for a user to trigger that in the viewer without systemic changes? Not sure.
Reading https://bugzilla.mozilla.org/show_bug.cgi?id=866522, it has been a "bug" for 13 years that bookmarklets are affected by CSPs at all.
That bug has been inactive for a long time, so I have no hope there.
It seems you can change CSS with a userContent.css file, but I don't see how that could be used to create an "on/off" switch.
You're right, it isn't interactive.
Regarding the recent change, it appears that having "unsafe-inline" CSS was to allow some print-time style changes and it was removed after finding a different CSP bypass:
https://github.com/mozilla/pdf.js/commit/5ca6026d80f839c4563ea879d343483a7a4d0bd9
It cool that there's a bypass, but it requires JavaScript, so it seems to be a dead end for users.
Very challenging.