I have JavaScript that works when ran as a Bookmarklet. So, I know the code works.
However, I'm trying to avoid having to paste the bookmarklet to the bookmarks bar every time the code changes. The code changes on every document that we create, from our MIS system.
I want to be able to execute the JavaScript from the clipboard. Here's how I'm trying to do this:
javascript: window.focus();setTimeout(async () => {
const text = await navigator.clipboard.readText();
console.log(text);eval(text);
}, 2000);
It seems simple, get the text from the clipboard, then run it.
I know the text is being captured from the clipboard, because it is showing up on the console log.
What am I doing wrong?
I won't go into how I feel this is a spectacularly bad idea from a security perspective. I'm not aware of your environment so perhaps you have some means to ensure no malicious code ends up in the clipboard.
Perhaps CSP is blocking eval. If so you'll need to add the "unsafe-eval" value to the CSP. Are there any console log errors?