Open Bug 774065 Opened 13 years ago Updated 1 year ago

Replace bookmarklets with "user-script buttons"

Categories

(Firefox :: General, enhancement)

enhancement

Tracking

()

People

(Reporter: jruderman, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-spoof, sec-want, uiwanted)

Attachments

(1 file)

We should make "user-script buttons" be a type of add-on, replacing the concept of bookmarklets. Treating "user-script buttons" as a type of bookmark is suboptimal for UX: * Sites that offer bookmarklets have to explain what's going on. * Wrong icons (bug 72374, bug 701109) * Users can't easily view and edit the scripts (bug 565270, plus escaping issues) * Users can't convert them into on-load scripts, and vice versa (cf bug 89016) It's also problematic for security: * Users don't realize they are adding a script (bug 249747, bug 371923) * Since bookmarklets are hard to explain, many sites offer higher-privileged extensions than are necessary. For supporting legacy bookmarklets, I'd suggest: * Right-clicking a javascript: URL should show "Add Button to Firefox" instead of "Bookmark This Link". * Dragging a javascript: URL should highlight a drop target for adding buttons. * The default icon is the site's (e.g. the Pocket button gets the Pocket icon). For feature parity with bookmarks, the new feature would have to: * Let users assign URL keywords to add-on buttons * Let users organize add-on buttons into menus * Let users change the names of add-on buttons after they are added (It would be nice if we could do these things for "normal" add-on buttons too! cf bug 364307)
Hmm. My first (and probably most pragmatic) thought is that this is add-on material, akin to Greasemonkey. OTOH, there's an interesting argument to be made for pulling-in / improving on popular add-ons like that, as well as an interesting "hack your browser" angle (call it a super-lightweight addon) that makes it really easy to do simple things and act as a stepping-stone to more complex jetpack/addon development.
(In reply to Justin Dolske [:Dolske] from comment #1) > akin to Greasemonkey. See also bug 89016. I think having this as a separate add-on type is overkill - its not different enough from normal addons, jetpack-based addons, and Greasemonkey-style content scripts. But I can see it fitting in as a user-settable option (and/or API) for content scripts, if we ever go ahead with something like bug 89016.
Keywords: csec-spoof
I can make a Jetpack do this.
Assignee: nobody → evold
(In reply to Justin Dolske [:Dolske] from comment #1) > Hmm. My first (and probably most pragmatic) thought is that this is add-on > material, akin to Greasemonkey. Is support for javascript: URLs as bookmarks add-on material?
Assignee: evold → nobody
Blocks: self-xss
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: