Sleazy Fork permits the use of external code in specific cases. Any script found to be including external code outside of what is permitted is subject to be deleted. If you find a script violating these rules, please report it.
Note that these rules only apply to external, executable code. Loading non-executable code, for example JSON or CSS, is not restricted.
Racja bytu
User scripts have the technical ability to load and execute other scripts. This can be done in a few different ways, including:
- The
@requireand@resourcemetadata keys. XmlHttpRequestto download the script, thenevalto execute.- Adding a
<script>tag dynamically. - Webpack's
externalsoption. - Performing an update of the script, whether performed automatically or by directing the user to perform an action.
While this is a useful feature and most script authors use this for legitimate purposes, it can also be used maliciously. One of the core principles of Sleazy Fork is that the user must be able to inspect the code in a script. External scripts can bypass this principle in a number of ways: they can change without warning or history, they can serve up different code to different people, and they can be used to hide malicious code in the middle of known libraries. Even if someone were to check an external script and determine it to be legitimate, that would be no guarantee that that script always has been or always will be legitimate.
Dozwolone zewnętrzne kody
The following are the ways external code is allowed on Sleazy Fork. Unless otherwise specified, all other rules for code apply to the external code.
Sieci CDN (content delivery networks)
Code from CDNs is allowed. See a list of recognized CDNs. This code may be minified, but not obfuscated.
Scripts with subresource integrity hashes
Use of @require and @resource with URLs with subresource integrity in the Tampermonkey format is allowed.
biblioteki Sleazy Fork
Scripts posted as libraries on Sleazy Fork are allowed. Libraries can be created by choosing the option when creating a new script. These can additionally be set to sync from an external URL, like a GitHub repository.
Wklejanie skryptów z hosta źródłowego
Wstrzyknięcie zewnętrznych skryptów w tej samej domenie, z której pochodzą jest dozwolone. Jeśli skrypt zostaje uruchomiony na https://example.com, pobiera https://example.com/script.js, modyfikuje oraz wstrzykuje do https://example.com/, to jest to dozwolone.
Jeśli https://example.com/script.js jest wstrzykiwany do https://differentsite.com, to jest to niedozwolone.