Experimental user scripts support: added a flag in ui to allow evals in scripts

build/patches/Experimental-user-scripts-support.patch

@@ -20,6 +20,8 @@ document-idle), homepage, url_source
 
 The UI also allows you to see the source of the script.
 
+2022-18-01: added a flag in ui to allow evals in scripts
+
 See also: components/user_scripts/README.md
 ---
  chrome/android/BUILD.gn                       |   5 +
@@ -46,7 +48,12 @@ See also: components/user_scripts/README.md
  .../renderer/chrome_render_thread_observer.cc |   3 +
  components/components_strings.grd             |   1 +
  components/user_scripts/README.md             | 150 ++++
- components/user_scripts/android/BUILD.gn      |  80 ++
+ components/user_scripts/android/BUILD.gn      |  85 ++
+ .../java/res/drawable-hdpi/ic_check_24dp.png  | Bin 0 -> 198 bytes
+ .../java/res/drawable-mdpi/ic_check_24dp.png  | Bin 0 -> 151 bytes
+ .../java/res/drawable-xhdpi/ic_check_24dp.png | Bin 0 -> 195 bytes
+ .../res/drawable-xxhdpi/ic_check_24dp.png     | Bin 0 -> 221 bytes
+ .../res/drawable-xxxhdpi/ic_check_24dp.png    | Bin 0 -> 259 bytes
  .../java/res/layout/accept_script_item.xml    | 160 ++++
  .../java/res/layout/accept_script_list.xml    |  10 +
  .../java/res/layout/scripts_preference.xml    |  40 +
@@ -55,13 +62,13 @@ See also: components/user_scripts/README.md
  .../user_scripts/UserScriptsUtils.java        |  84 ++
  .../user_scripts/FragmentWindowAndroid.java   |  89 ++
  .../user_scripts/IUserScriptsUtils.java       |  22 +
- .../components/user_scripts/ScriptInfo.java   |  37 +
+ .../components/user_scripts/ScriptInfo.java   |  38 +
  .../user_scripts/ScriptListBaseAdapter.java   | 163 ++++
- .../user_scripts/ScriptListPreference.java    | 171 ++++
- .../user_scripts/UserScriptsBridge.java       | 200 +++++
+ .../user_scripts/ScriptListPreference.java    | 176 ++++
+ .../user_scripts/UserScriptsBridge.java       | 206 +++++
  .../user_scripts/UserScriptsPreferences.java  | 116 +++
  .../user_scripts/android/java_sources.gni     |  18 +
- .../android/user_scripts_bridge.cc            | 173 ++++
+ .../android/user_scripts_bridge.cc            | 184 ++++
  .../android/user_scripts_bridge.h             |  31 +
  components/user_scripts/browser/BUILD.gn      |  82 ++
  .../user_scripts/browser/file_task_runner.cc  |  40 +
@@ -72,12 +79,12 @@ See also: components/user_scripts/README.md
  .../user-script-ui/user-scripts-ui.js         |   9 +
  .../browser/ui/user_scripts_ui.cc             | 148 ++++
  .../user_scripts/browser/ui/user_scripts_ui.h |  39 +
- .../browser/user_script_loader.cc             | 714 ++++++++++++++++
- .../user_scripts/browser/user_script_loader.h | 170 ++++
- .../browser/user_script_pref_info.cc          |  34 +
- .../browser/user_script_pref_info.h           |  72 ++
- .../user_scripts/browser/user_script_prefs.cc | 276 ++++++
- .../user_scripts/browser/user_script_prefs.h  |  62 ++
+ .../browser/user_script_loader.cc             | 720 ++++++++++++++++
+ .../user_scripts/browser/user_script_loader.h | 171 ++++
+ .../browser/user_script_pref_info.cc          |  35 +
+ .../browser/user_script_pref_info.h           |  73 ++
+ .../user_scripts/browser/user_script_prefs.cc | 287 +++++++
+ .../user_scripts/browser/user_script_prefs.h  |  63 ++
  .../browser/userscripts_browser_client.cc     |  78 ++
  .../browser/userscripts_browser_client.h      |  62 ++
  components/user_scripts/common/BUILD.gn       |  49 ++
@@ -95,8 +102,8 @@ See also: components/user_scripts/README.md
  components/user_scripts/common/url_pattern.h  | 302 +++++++
  .../user_scripts/common/url_pattern_set.cc    | 335 ++++++++
  .../user_scripts/common/url_pattern_set.h     | 161 ++++
- components/user_scripts/common/user_script.cc | 325 +++++++
- components/user_scripts/common/user_script.h  | 403 +++++++++
+ components/user_scripts/common/user_script.cc | 327 +++++++
+ components/user_scripts/common/user_script.h  | 409 +++++++++
  .../common/user_scripts_features.cc           |  32 +
  .../common/user_scripts_features.h            |  34 +
  components/user_scripts/common/view_type.cc   |  39 +
@@ -129,13 +136,18 @@ See also: components/user_scripts/README.md
  .../renderer/user_scripts_dispatcher.h        |  48 ++
  .../renderer/user_scripts_renderer_client.cc  | 105 +++
  .../renderer/user_scripts_renderer_client.h   |  36 +
- .../renderer/web_ui_injection_host.cc         |  40 +
- .../renderer/web_ui_injection_host.h          |  28 +
- .../strings/userscripts_strings.grdp          |  55 ++
+ .../renderer/web_ui_injection_host.cc         |  47 +
+ .../renderer/web_ui_injection_host.h          |  29 +
+ .../strings/userscripts_strings.grdp          |  58 ++
  tools/gritsettings/resource_ids.spec          |   6 +
- 111 files changed, 9584 insertions(+), 2 deletions(-)
+ 116 files changed, 9652 insertions(+), 2 deletions(-)
  create mode 100644 components/user_scripts/README.md
  create mode 100755 components/user_scripts/android/BUILD.gn
+ create mode 100644 components/user_scripts/android/java/res/drawable-hdpi/ic_check_24dp.png
+ create mode 100644 components/user_scripts/android/java/res/drawable-mdpi/ic_check_24dp.png
+ create mode 100644 components/user_scripts/android/java/res/drawable-xhdpi/ic_check_24dp.png
+ create mode 100644 components/user_scripts/android/java/res/drawable-xxhdpi/ic_check_24dp.png
+ create mode 100644 components/user_scripts/android/java/res/drawable-xxxhdpi/ic_check_24dp.png
  create mode 100644 components/user_scripts/android/java/res/layout/accept_script_item.xml
  create mode 100644 components/user_scripts/android/java/res/layout/accept_script_list.xml
  create mode 100644 components/user_scripts/android/java/res/layout/scripts_preference.xml
@@ -859,7 +871,7 @@ diff --git a/components/user_scripts/android/BUILD.gn b/components/user_scripts/
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/android/BUILD.gn
-@@ -0,0 +1,80 @@
+@@ -0,0 +1,85 @@
 +# This file is part of Bromite.
 +
 +# Bromite is free software: you can redistribute it and/or modify
@@ -887,7 +899,12 @@ new file mode 100755
 +    "java/res/layout/accept_script_item.xml",
 +    "java/res/layout/accept_script_list.xml",
 +    "java/res/layout/scripts_preference.xml",
-+    "java/res/values/dimens.xml"
++    "java/res/values/dimens.xml",
++    "java/res/drawable-hdpi/ic_check_24dp.png",
++    "java/res/drawable-mdpi/ic_check_24dp.png",
++    "java/res/drawable-xhdpi/ic_check_24dp.png",
++    "java/res/drawable-xxhdpi/ic_check_24dp.png",
++    "java/res/drawable-xxxhdpi/ic_check_24dp.png",
 +   ]
 +
 +  deps = [
@@ -940,6 +957,72 @@ new file mode 100755
 +    "//content/public/browser",
 +  ]
 +}
+diff --git a/components/user_scripts/android/java/res/drawable-hdpi/ic_check_24dp.png b/components/user_scripts/android/java/res/drawable-hdpi/ic_check_24dp.png
+new file mode 100644
+index 0000000000000000000000000000000000000000..bbfe76c2a5882f9a21e1348817ac7b5c69570940
+GIT binary patch
+literal 198
+zcmeAS@N?(olHy`uVBq!ia0vp^Dj>|k3?#4J%UA`Z<N|y`T!FM-<7dy@+kTB-d>TFj
+zNx!Bqo(*sPnm+qCebMAEy#-XkSrX(I%+SET%^`X_-@B46T*4r2o-U3d6>)FRX!A8V
+z2pkA_w%Or*eWJ)JMdgB)SJU&}|2}OxTPMlH`od%ON5W}ObDB<_GzrjLEWCZwMi8{h
+nS>q?IEv=mslkoT#<Db|MCd}^4lG5*hCNp@t`njxgN@xNA<Znr!
+
+literal 0
+HcmV?d00001
+
+diff --git a/components/user_scripts/android/java/res/drawable-mdpi/ic_check_24dp.png b/components/user_scripts/android/java/res/drawable-mdpi/ic_check_24dp.png
+new file mode 100644
+index 0000000000000000000000000000000000000000..b6b5ba2dc10f6e22b217523112d580fa22758006
+GIT binary patch
+literal 151
+zcmeAS@N?(olHy`uVBq!ia0vp^5+KaM1|%Pp+x`Gjah@)YAr*|t3Y<Mnfe-F}h-^=5
+z`)yLk_dWmDr{n8C7BipaVSn_0O0+@Nj{LXjxw9nsf_N@*7&X)!=8XOzpUC;NO?X?&
+zhKEz4oemV7(p5~bcsgx?v|p+B2Pr!)H%5lvZ<qD{sb}H_+Qi`L>gTe~DWM4f?DIFY
+
+literal 0
+HcmV?d00001
+
+diff --git a/components/user_scripts/android/java/res/drawable-xhdpi/ic_check_24dp.png b/components/user_scripts/android/java/res/drawable-xhdpi/ic_check_24dp.png
+new file mode 100644
+index 0000000000000000000000000000000000000000..334c5cb57d09ca1d75b886687ca579ee7ea1109e
+GIT binary patch
+literal 195
+zcmeAS@N?(olHy`uVBq!ia0vp^1|ZDA3?vioaBc-sq5(c3u0Yza@w0!^XP<_T{!Kvi
+z$-n8#VVhqZKnb>zAirRSh7V@u7272f_W(u0JzX3_D&pRrHWX?w;9zj%ocQ1V=E;cs
+zgEt}yzTW$~GV|2#m*K9L#rb}B#sB(P{;lT9sd?**4<uW#@8PeI|II2b$G(TJQvQS8
+ogW3a+8_F5qGu=D-@$wgjrA5pyJG0lm23o=3>FVdQ&MBb@07=_S`Tzg`
+
+literal 0
+HcmV?d00001
+
+diff --git a/components/user_scripts/android/java/res/drawable-xxhdpi/ic_check_24dp.png b/components/user_scripts/android/java/res/drawable-xxhdpi/ic_check_24dp.png
+new file mode 100644
+index 0000000000000000000000000000000000000000..874ae256c0fa58101c041faddf95d1f806420b29
+GIT binary patch
+literal 221
+zcmeAS@N?(olHy`uVBq!ia0vp^9w5xY3?!3`olAj~P=HT}E0FeU{0u~H)o(o;-ugFv
+zS;)V~3@FN4666=m&~R6lZ`1bhPe6fEPZ!6KinzCD4ssrG5MVL<zE1uBl=t!HlO7ms
+zVY=|SHZ=78rDFeS^JePU&iQlrr2XXmcD290R8F5aXZPnb377cQ{w5TipL|e7-tXVT
+zCm`a;ale{3M~?f~{AoGvU-75KokLE)V$Xw*O~<)Gj1KqJt9~*1cd)-~{ds#1&;bmd
+Lu6{1-oD!M<>nL6Y
+
+literal 0
+HcmV?d00001
+
+diff --git a/components/user_scripts/android/java/res/drawable-xxxhdpi/ic_check_24dp.png b/components/user_scripts/android/java/res/drawable-xxxhdpi/ic_check_24dp.png
+new file mode 100644
+index 0000000000000000000000000000000000000000..aff92288342ddf866599cd946c349e5b03d2f4d0
+GIT binary patch
+literal 259
+zcmeAS@N?(olHy`uVBq!ia0vp^2_VeE3?v1%WpM*3p#Yx{S0L@z_!)>C8eaJ~e)4bn
+z6853a3n<E3666=m&~TV1QR{YFAW&eor;B4qMcmtS8+n-=d0Y=V2OLlfDNu?JWYm4*
+z`EI}H7FM4J4ITgEb9(!AmVW7eH(%{TobQ9s#q1$#)dCba8U!9NGn+DPU|^Kn%xQC8
+zu3&Zcw}w@l*{`TY9Z+L<@n9Cihf8V<GZ+$_8aNr$SdbY^AQ7Mx1DJs#mBg&MwEm{J
+Y{FSP<=X|f80iDU<>FVdQ&MBb@0GpUptN;K2
+
+literal 0
+HcmV?d00001
+
 diff --git a/components/user_scripts/android/java/res/layout/accept_script_item.xml b/components/user_scripts/android/java/res/layout/accept_script_item.xml
 new file mode 100644
 --- /dev/null
@@ -1440,7 +1523,7 @@ diff --git a/components/user_scripts/android/java/src/org/chromium/components/us
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/android/java/src/org/chromium/components/user_scripts/ScriptInfo.java
-@@ -0,0 +1,37 @@
+@@ -0,0 +1,38 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -1474,6 +1557,7 @@ new file mode 100644
 +    public LocalDateTime InstallTime;
 +
 +    public String ParserError;
++    public boolean UseInsecureCSP;
 +    public boolean ForceDisabled;
 +
 +    public ScriptInfo() {}
@@ -1650,7 +1734,7 @@ diff --git a/components/user_scripts/android/java/src/org/chromium/components/us
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/android/java/src/org/chromium/components/user_scripts/ScriptListPreference.java
-@@ -0,0 +1,171 @@
+@@ -0,0 +1,176 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -1722,9 +1806,12 @@ new file mode 100644
 +
 +            ModelList menuItems = new ModelList();
 +
-+            menuItems.add(buildMenuListItem(R.string.remove, 0, 0, true));
-+            menuItems.add(buildMenuListItem(R.string.scripts_view_source, 0, 0,
++            menuItems.add(buildMenuListItemWithEndIcon(
++                                            R.string.scripts_insecure_csp, 3,
++                                            (info.UseInsecureCSP ? R.drawable.ic_check_24dp : 0), true));
++            menuItems.add(buildMenuListItem(R.string.scripts_view_source, 2, 0,
 +                                                    info.ParserError == null || info.ParserError.isEmpty()));
++            menuItems.add(buildMenuListItem(R.string.remove, 1, 0, true));
 +
 +            ListMenu.Delegate delegate = (model) -> {
 +                int textId = model.get(ListMenuItemProperties.TITLE_ID);
@@ -1732,6 +1819,8 @@ new file mode 100644
 +                    UserScriptsBridge.RemoveScript(info.Key);
 +                } else if (textId == R.string.scripts_view_source) {
 +                    UserScriptsBridge.getUtils().openSourceFile(info.Key);
++                } else if (textId == R.string.scripts_insecure_csp) {
++                    UserScriptsBridge.SetScriptInsecure(info.Key, !info.UseInsecureCSP);
 +                }
 +            };
 +            ((ScriptInfoRowViewHolder) holder)
@@ -1822,12 +1911,11 @@ new file mode 100644
 +        }
 +    }
 +}
-\ No newline at end of file
 diff --git a/components/user_scripts/android/java/src/org/chromium/components/user_scripts/UserScriptsBridge.java b/components/user_scripts/android/java/src/org/chromium/components/user_scripts/UserScriptsBridge.java
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/android/java/src/org/chromium/components/user_scripts/UserScriptsBridge.java
-@@ -0,0 +1,200 @@
+@@ -0,0 +1,206 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -1904,6 +1992,11 @@ new file mode 100644
 +        UserScriptsBridgeJni.get().setScriptEnabled(key, enabled);
 +    }
 +
++    public static void SetScriptInsecure(String key,
++                                         boolean allowInsecure) {
++        UserScriptsBridgeJni.get().setScriptInsecure(key, allowInsecure);
++    }
++
 +    public static void Reload() {
 +        UserScriptsBridgeJni.get().reload();
 +    }
@@ -1977,7 +2070,8 @@ new file mode 100644
 +                    if(script.has("file_path")) si.FilePath = script.getString("file_path");
 +                    if(script.has("url_source")) si.UrlSource = script.getString("url_source");
 +                    if(script.has("parser_error")) si.ParserError = script.getString("parser_error");
-+                    if(script.has("force_disabled")) si.ForceDisabled = script.getBoolean("force_disabled");;
++                    if(script.has("insecure_csp")) si.UseInsecureCSP = script.getBoolean("insecure_csp");
++                    if(script.has("force_disabled")) si.ForceDisabled = script.getBoolean("force_disabled");
 +                    si.Enabled = script.getBoolean("enabled");
 +                }
 +            } else {
@@ -2019,6 +2113,7 @@ new file mode 100644
 +
 +        void removeScript(String scriptKey);
 +        void setScriptEnabled(String scriptKey, boolean enabled);
++        void setScriptInsecure(String scriptKey, boolean allowInsecure);
 +
 +        void reload();
 +        void selectAndAddScriptFromFile(WindowAndroid window);
@@ -2026,7 +2121,6 @@ new file mode 100644
 +
 +        void registerLoadCallback();
 +    }
-+
 +}
 diff --git a/components/user_scripts/android/java/src/org/chromium/components/user_scripts/UserScriptsPreferences.java b/components/user_scripts/android/java/src/org/chromium/components/user_scripts/UserScriptsPreferences.java
 new file mode 100755
@@ -2176,7 +2270,7 @@ diff --git a/components/user_scripts/android/user_scripts_bridge.cc b/components
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/android/user_scripts_bridge.cc
-@@ -0,0 +1,173 @@
+@@ -0,0 +1,184 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -2296,6 +2390,17 @@ new file mode 100644
 +  client->GetLoader()->SetScriptEnabled(script_key, is_enabled);
 +}
 +
++static void JNI_UserScriptsBridge_SetScriptInsecure(
++                    JNIEnv* env,
++                    const JavaParamRef<jstring>& jscript_key,
++                    jboolean allow_insecure) {
++  user_scripts::UserScriptsBrowserClient* client = GetUserScriptsBrowserClient();
++  if (client == NULL) return;
++
++  std::string script_key = base::android::ConvertJavaStringToUTF8(jscript_key);
++  client->GetLoader()->SetScriptInsecure(script_key, allow_insecure);
++}
++
 +static void JNI_UserScriptsBridge_Reload(
 +                    JNIEnv* env) {
 +  user_scripts::UserScriptsBrowserClient* client = GetUserScriptsBrowserClient();
@@ -2833,7 +2938,7 @@ diff --git a/components/user_scripts/browser/user_script_loader.cc b/components/
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/browser/user_script_loader.cc
-@@ -0,0 +1,714 @@
+@@ -0,0 +1,720 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -3397,6 +3502,12 @@ new file mode 100755
 +  StartLoad();
 +}
 +
++void UserScriptLoader::SetScriptInsecure(const std::string& script_id, bool allow_insecure) {
++  if (!prefs_->IsEnabled()) return;
++  prefs_->SetScriptInsecure(script_id, allow_insecure);
++  StartLoad();
++}
++
 +void UserScriptLoader::SelectAndAddScriptFromFile(ui::WindowAndroid* nativeWindow) {
 +  DCHECK_CURRENTLY_ON(BrowserThread::UI);
 +
@@ -3552,7 +3663,7 @@ diff --git a/components/user_scripts/browser/user_script_loader.h b/components/u
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/browser/user_script_loader.h
-@@ -0,0 +1,170 @@
+@@ -0,0 +1,171 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -3657,6 +3768,7 @@ new file mode 100755
 +
 +  void RemoveScript(const std::string& script_id);
 +  void SetScriptEnabled(const std::string& script_id, bool is_enabled);
++  void SetScriptInsecure(const std::string& script_id, bool allow_insecure);
 +
 +  void SelectAndAddScriptFromFile(ui::WindowAndroid* wa);
 +  void TryToInstall(const base::FilePath& script_path);
@@ -3727,7 +3839,7 @@ diff --git a/components/user_scripts/browser/user_script_pref_info.cc b/componen
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/browser/user_script_pref_info.cc
-@@ -0,0 +1,34 @@
+@@ -0,0 +1,35 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -3755,6 +3867,7 @@ new file mode 100644
 +                                             bool enabled)
 +    : install_time(install_time),
 +      enabled(enabled),
++      allow_insecure_csp(false),
 +      name_(name),
 +      description_(description) {}
 +
@@ -3762,12 +3875,11 @@ new file mode 100644
 +UserScriptsListPrefs::ScriptInfo::~ScriptInfo() = default;
 +
 +}
-\ No newline at end of file
 diff --git a/components/user_scripts/browser/user_script_pref_info.h b/components/user_scripts/browser/user_script_pref_info.h
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/browser/user_script_pref_info.h
-@@ -0,0 +1,72 @@
+@@ -0,0 +1,73 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -3825,6 +3937,7 @@ new file mode 100644
 +    base::Time install_time;
 +    bool enabled;
 +
++    bool allow_insecure_csp;
 +    bool force_disabled;
 +
 +  private:
@@ -3840,12 +3953,11 @@ new file mode 100644
 +}
 +
 +#endif // USERSCRIPTS_BROWSER_USERSCRIPT_PREF_INFO_H_
-\ No newline at end of file
 diff --git a/components/user_scripts/browser/user_script_prefs.cc b/components/user_scripts/browser/user_script_prefs.cc
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/browser/user_script_prefs.cc
-@@ -0,0 +1,276 @@
+@@ -0,0 +1,287 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -3900,6 +4012,7 @@ new file mode 100644
 +const char kScriptFilePath[] = "file_path";
 +const char kScriptUrlSource[] = "url_source";
 +const char kScriptParserError[] = "parser_error";
++const char kScriptAllowInsecureCSP[] = "insecure_csp";
 +const char kScriptForceDisabled[] = "force_disabled";
 +
 +class PrefUpdate : public DictionaryPrefUpdate {
@@ -4005,7 +4118,7 @@ new file mode 100644
 +    scriptInfo->set_file_path(it->get()->file_path());
 +    scriptInfo->set_url_source(it->get()->url_source());
 +    scriptInfo->set_parser_error(it->get()->parser_error());
-+    scriptInfo->force_disabled = (it->get()->force_disabled());
++    scriptInfo->force_disabled = it->get()->force_disabled();
 +
 +    PrefUpdate update(prefs_, key, kUserScriptsList);
 +    base::DictionaryValue* script_dict = update.Get();
@@ -4017,8 +4130,11 @@ new file mode 100644
 +    script_dict->SetString(kScriptFilePath, scriptInfo->file_path());
 +    script_dict->SetString(kScriptUrlSource, scriptInfo->url_source());
 +    script_dict->SetString(kScriptParserError, scriptInfo->parser_error());
++    script_dict->SetBoolean(kScriptAllowInsecureCSP, scriptInfo->allow_insecure_csp);
 +    script_dict->SetBoolean(kScriptForceDisabled, scriptInfo->force_disabled);
 +
++    it->get()->set_allow_insecure_csp(scriptInfo->allow_insecure_csp);
++
 +    std::string install_time_str =
 +        base::NumberToString(scriptInfo->install_time.ToInternalValue());
 +    script_dict->SetString(kScriptInstallTime, install_time_str);
@@ -4097,6 +4213,7 @@ new file mode 100644
 +  scriptInfo->set_file_path( file_path ? *file_path : "no file path" );
 +  scriptInfo->set_url_source( url_source ? *url_source : "" );
 +  scriptInfo->set_parser_error( parser_error ? *parser_error : "" );
++  scriptInfo->allow_insecure_csp = script->FindBoolKey(kScriptAllowInsecureCSP).value_or(false);
 +  scriptInfo->force_disabled = script->FindBoolKey(kScriptForceDisabled).value_or(false);
 +
 +  int64_t time_interval = 0;
@@ -4121,12 +4238,18 @@ new file mode 100644
 +  script_dict->SetBoolean(kScriptIsEnabled, is_enabled);
 +}
 +
++void UserScriptsPrefs::SetScriptInsecure(const std::string& script_id, bool allow_insecure) {
++  PrefUpdate update(prefs_, script_id, kUserScriptsList);
++  base::DictionaryValue* script_dict = update.Get();
++  script_dict->SetBoolean(kScriptAllowInsecureCSP, allow_insecure);
++}
++
 +}
 diff --git a/components/user_scripts/browser/user_script_prefs.h b/components/user_scripts/browser/user_script_prefs.h
 new file mode 100644
 --- /dev/null
 +++ b/components/user_scripts/browser/user_script_prefs.h
-@@ -0,0 +1,62 @@
+@@ -0,0 +1,63 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -4178,6 +4301,7 @@ new file mode 100644
 +    std::string GetScriptsInfo();
 +    void RemoveScriptFromPrefs(const std::string& script_id);
 +    void SetScriptEnabled(const std::string& script_id, bool is_enabled);
++    void SetScriptInsecure(const std::string& script_id, bool allow_insecure);
 +
 +    std::unique_ptr<UserScriptsListPrefs::ScriptInfo> CreateScriptInfoFromPrefs(
 +        const std::string& script_id) const;
@@ -4189,7 +4313,6 @@ new file mode 100644
 +}
 +
 +#endif // USERSCRIPTS_BROWSER_USERSCRIPT_PREFS_H_
-\ No newline at end of file
 diff --git a/components/user_scripts/browser/userscripts_browser_client.cc b/components/user_scripts/browser/userscripts_browser_client.cc
 new file mode 100755
 --- /dev/null
@@ -6418,7 +6541,7 @@ diff --git a/components/user_scripts/common/user_script.cc b/components/user_scr
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/common/user_script.cc
-@@ -0,0 +1,325 @@
+@@ -0,0 +1,327 @@
 +// Copyright 2013 The Chromium Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -6598,6 +6721,7 @@ new file mode 100755
 +  pickle->WriteBool(match_all_frames());
 +  pickle->WriteInt(static_cast<int>(match_origin_as_fallback()));
 +  pickle->WriteBool(is_incognito_enabled());
++  pickle->WriteBool(allow_insecure_csp());
 +
 +  PickleHostID(pickle, host_id_);
 +  pickle->WriteInt(consumer_instance_type());
@@ -6657,6 +6781,7 @@ new file mode 100755
 +  match_origin_as_fallback_ =
 +      static_cast<MatchOriginAsFallbackBehavior>(match_origin_as_fallback_int);
 +  CHECK(iter->ReadBool(&incognito_enabled_));
++  CHECK(iter->ReadBool(&allow_insecure_csp_));
 +
 +  UnpickleHostID(pickle, iter, &host_id_);
 +
@@ -6748,7 +6873,7 @@ diff --git a/components/user_scripts/common/user_script.h b/components/user_scri
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/common/user_script.h
-@@ -0,0 +1,403 @@
+@@ -0,0 +1,409 @@
 +// Copyright 2013 The Chromium Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -6998,6 +7123,9 @@ new file mode 100755
 +  const HostID& host_id() const { return host_id_; }
 +  void set_host_id(const HostID& host_id) { host_id_ = host_id; }
 +
++  bool allow_insecure_csp() const { return allow_insecure_csp_; }
++  void set_allow_insecure_csp(bool insecure) { allow_insecure_csp_ = insecure; }
++
 +  const ConsumerInstanceType& consumer_instance_type() const {
 +    return consumer_instance_type_;
 +  }
@@ -7113,6 +7241,9 @@ new file mode 100755
 +  // "invalid".
 +  int user_script_id_ = -1;
 +
++  // Allow the use of evals in scripts
++  bool allow_insecure_csp_ = false;
++
 +  // Whether we should try to emulate Greasemonkey's APIs when running this
 +  // script.
 +  bool emulate_greasemonkey_ = false;
@@ -9888,7 +10019,7 @@ new file mode 100755
 +  blink::WebLocalFrame* web_frame = render_frame->GetWebFrame();
 +
 +  const HostID& host_id = script->host_id();
-+  injection_host.reset(new WebUIInjectionHost(host_id));
++  injection_host.reset(new WebUIInjectionHost(host_id, script->allow_insecure_csp()));
 +
 +  GURL effective_document_url =
 +      ScriptContext::GetEffectiveDocumentURLForInjection(
@@ -10488,7 +10619,7 @@ diff --git a/components/user_scripts/renderer/web_ui_injection_host.cc b/compone
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/renderer/web_ui_injection_host.cc
-@@ -0,0 +1,40 @@
+@@ -0,0 +1,47 @@
 +// Copyright 2015 The Chromium Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -10499,13 +10630,14 @@ new file mode 100755
 +namespace {
 +
 +// The default secure CSP to be used in order to prevent remote scripts.
-+// use "script-src 'self' 'unsafe-eval'; object-src 'self';" to enable eval
 +const char kDefaultSecureCSP[] = "script-src 'self'; object-src 'self';";
++const char kDefaultInsecureCSP[] = "script-src 'self' 'unsafe-eval'; object-src 'self';";
 +}
 +
-+WebUIInjectionHost::WebUIInjectionHost(const HostID& host_id)
++WebUIInjectionHost::WebUIInjectionHost(const HostID& host_id, bool allow_insecure_csp)
 +  : InjectionHost(host_id),
-+    url_(host_id.id()) {
++    url_(host_id.id()),
++    allow_insecure_csp_(allow_insecure_csp) {
 +}
 +
 +WebUIInjectionHost::~WebUIInjectionHost() {
@@ -10517,9 +10649,15 @@ new file mode 100755
 +
 +  // The isolated world will use its own CSP which blocks remotely hosted
 +  // code.
-+  static const base::NoDestructor<std::string> default_isolated_world_csp(
-+      kDefaultSecureCSP);
-+  return default_isolated_world_csp.get();
++  if (allow_insecure_csp_ == false) {
++    static const base::NoDestructor<std::string> default_isolated_world_csp(
++        kDefaultSecureCSP);
++    return default_isolated_world_csp.get();
++  } else {
++    static const base::NoDestructor<std::string> default_insecure_isolated_world_csp(
++        kDefaultInsecureCSP);
++    return default_insecure_isolated_world_csp.get();
++  }
 +}
 +
 +const GURL& WebUIInjectionHost::url() const {
@@ -10533,7 +10671,7 @@ diff --git a/components/user_scripts/renderer/web_ui_injection_host.h b/componen
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/renderer/web_ui_injection_host.h
-@@ -0,0 +1,28 @@
+@@ -0,0 +1,29 @@
 +// Copyright 2015 The Chromium Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -10546,7 +10684,7 @@ new file mode 100755
 +
 +class WebUIInjectionHost : public InjectionHost {
 + public:
-+  WebUIInjectionHost(const HostID& host_id);
++  WebUIInjectionHost(const HostID& host_id, bool allow_insecure_csp);
 +  ~WebUIInjectionHost() override;
 +
 + private:
@@ -10557,6 +10695,7 @@ new file mode 100755
 +
 + private:
 +  GURL url_;
++  bool allow_insecure_csp_;
 +
 +  DISALLOW_COPY_AND_ASSIGN(WebUIInjectionHost);
 +};
@@ -10566,7 +10705,7 @@ diff --git a/components/user_scripts/strings/userscripts_strings.grdp b/componen
 new file mode 100755
 --- /dev/null
 +++ b/components/user_scripts/strings/userscripts_strings.grdp
-@@ -0,0 +1,55 @@
+@@ -0,0 +1,58 @@
 +<?xml version="1.0" encoding="utf-8"?>
 +<grit-part>
 +
@@ -10604,6 +10743,9 @@ new file mode 100755
 +  <message name="IDS_SCRIPTS_ITEM_URL" desc="." formatter_data="android_java">
 +    Url:
 +  </message>
++  <message name="IDS_SCRIPTS_INSECURE_CSP" desc=". [CHAR-LIMIT=32]" formatter_data="android_java">
++    Allow insecure CSP
++  </message>
 +
 +  <message name="IDS_SCRIPTS_VIEW_SOURCE" desc=". [CHAR-LIMIT=32]" formatter_data="android_java">
 +    View source
@@ -10622,7 +10764,6 @@ new file mode 100755
 +  </message>
 +
 +</grit-part>
-\ No newline at end of file
 diff --git a/tools/gritsettings/resource_ids.spec b/tools/gritsettings/resource_ids.spec
 --- a/tools/gritsettings/resource_ids.spec
 +++ b/tools/gritsettings/resource_ids.spec