security issue?

[enjalot]

I tried to run it on the github issue comments (i.e. this page) and it gave me the following error:

Refused to load the script 'https://nthitz.github.io/d3fx/index.js' because it violates the following Content Security Policy directive: "script-src assets-cdn.github.com".

the same on twitter. Is this a thing only some sites add?

[nthitz]

ah yes indeed. Sites can specify a "Content Security Policy" which has a directive that whitelists domains that <script>s are allowed to have as a src. Any bookmarklet that creates <script> tags would fail on sites that specify that header. Github, Twitter, Facebook all do :(. Google doesn't ¯_(ツ)_/¯

You'll notice that the javascript that creates the <script> still executes so the "inline" JS in the bookmarklet still runs. So you could presumably include all of d3 and d3fx within a bookmarklet (w/o external scripts) and have things work. Not sure if Chrome extensions have the same restrictions, but if they are adding <script>s with unwhitelisted src attributes they probably do.

http://www.html5rocks.com/en/tutorials/security/content-security-policy/