-
Notifications
You must be signed in to change notification settings - Fork 653
Description
Environment
• macOS: 26.0 (build 25A354)
• Hardware: MacBook Pro 16”, Apple M4 Max, 64 GB RAM
• Orion: 0.99.136-rc (WebKit 622.1.15.19.2), build Sep 3, 2025
• Violentmonkey: v2.31.0 (Firefox build)
• Other extensions: repro also with only Violentmonkey enabled
• Substitutions: macOS Smart Quotes/Dashes OFF, Orion Smart Quotes/Dashes OFF
Summary
After a clean save and app restart, userscript source stored by Violentmonkey opens altered: ASCII quotes are changed or duplicated, producing a SyntaxError at load time. This occurs without any manual edits. It makes userscripts unreliable on Orion.
Steps to Reproduce
1. Install Violentmonkey (Firefox build) in Orion RC.
2. Dashboard → New → paste the minimal script below → Save.
3. Quit Orion completely.
4. Relaunch Orion, open the same script in VM editor.
5. Observe the source has changed; loading the script triggers SyntaxError.
Minimal script used in step 2
// ==UserScript==
// @name VM-Quote-Repro
// @match :///*
// @run-at document-start
// @grant none
// ==/UserScript==
(function(){
var s = '';
var t = 'PDF_BLOB_VIEWER_TAB';
if (typeof s !== 'string') console.log('type mismatch');
})();
Expected
• Script source persists byte-for-byte across restarts.
• No SyntaxError at load.
Actual
• On reopen after restart, some strings have changed. Examples seen:
• var s = ''; becomes var s = '''';
• Straight quotes replaced or duplicated; sometimes curly quotes appear.
• The mutated code fails to load with SyntaxError before any page logic runs.
Additional observations
• The effect happens even if the script is created cleanly once, then the browser is closed and reopened without any edits in between.
• Installing the same script from a Gist via @downloadURL/@updateURL works initially, but after an Orion restart the locally stored copy shown in VM editor is altered and fails to inject with the same SyntaxError.
• To keep scripts working, I had to rewrite logic using quote-less constructions (e.g., constructing strings from char codes) so there are no ' or " in the file; this is a fragile workaround, not a fix.
• Violentmonkey Sync = OFF during all tests.
• Repro occurs on regular web pages (not about:, chrome:, or extension pages).
What I tried (did not resolve)
• Disabled macOS and Orion Smart Quotes/Dashes.
• Fresh Violentmonkey install, only VM enabled.
• Reinstall from Gist RAW, bumping @Version.
• Network-loader variant using GM.xmlHttpRequest from gist.githubusercontent.com; still had to remove all literal quotes in the loader itself to survive a restart.
Impact
Userscripts cannot be trusted to persist; source corruption across restarts blocks script execution on every relaunch.
Hypothesis
The mutation likely happens in Orion’s WebExtensions storage path or editor serialization for extension data, altering ASCII quote characters when VM reloads its stored scripts after a browser restart.
Attachments (available on request)
• Before/after screenshots of the VM editor showing the exact source changes.
• Console trace with the SyntaxError line numbers.
• Gist RAW link to the test script.
Request
Please investigate the persistence/serialization of extension storage for userscripts. I can provide a minimal profile and the before/after files to help reproduce.