tampermonkey как сделать свой скрипт

@match

Multiple tag instances are allowed.

@exclude

Multiple tag instances are allowed.

@require

@resource

@connect

If it’s not possible to declare all domains a userscript might connect to then it’s a good practice to do the following:
Declare all known or at least all common domains that might be connected by the script. This way the confirmation dialog can be avoided for most of the users.

Additionally add «@connect *» to the script. By doing so Tampermonkey will still ask the user whether the next connection to a not mentioned domain is allowed, but also offer a «Always allow all domains» button. If the user clicks at this button then all future requests will be permitted automatically.

Users can also whitelist all requests by adding ‘*’ to the user domain whitelist at the script settings tab.

@run-at

@grant

Since closing and focusing tabs is a powerful feature this needs to be added to the @grant statements as well.

If a script runs on a single-page application, then it can use window.onurlchange to listen for URL changes:

// ==UserScript==
.
// @grant window.onurlchange
// ==/UserScript==

@antifeature

This tag allows script developers to disclose whether they monetize their scripts. It is for example required by GreasyFork.

@noframes

@unwrap

@nocompat

unsafeWindow

Subresource Integrity

TM supports SHA-256 and MD5 hashes natively, all other (SHA-1, SHA-384 and SHA-512) depend on window.crypto. In case multiple hashes (separated by comma or semicolon) are given the last currently supported one is used by TM. If the content of the external resource doesn’t match the selected hash, then the resource is not delivered to the userscript.

All hashes need to be encoded in hex or Base64 format.

GM_addStyle(css)

GM_addElement(tag_name, attributes), GM_addElement(parent_node, tag_name, attributes)

Creates an HTML element specified by ‘tag_name’ and applies all given ‘attributes’ and returns the injected HTML element. If a ‘parent_node’ is given, then it is attached to it or to document head or body otherwise.

GM_addElement(‘script’, <
textContent: ‘window.foo = «bar»;’
>);

GM_addElement(‘script’, <
src: ‘https://example.com/script.js’,
type: ‘text/javascript’
>);

GM_addElement(document.getElementsByTagName(‘div’)[0], ‘img’, <
src: ‘https://example.com/image.png’
>);

GM_deleteValue(name)

GM_listValues()

GM_addValueChangeListener(name, function(name, old_value, new_value, remote) <>)

GM_removeValueChangeListener(listener_id)

GM_setValue(name, value)

GM_getValue(name, defaultValue)

GM_log(message)

GM_getResourceText(name)

GM_getResourceURL(name)

GM_registerMenuCommand(name, fn, accessKey)

GM_unregisterMenuCommand(menuCmdId)

GM_openInTab(url, options), GM_openInTab(url, loadInBackground)

GM_xmlhttpRequest(details)

Make an xmlHttpRequest.

Important: if you want to use this method then please also check the documentation about @connect.

Источник

Tampermonkey как сделать свой скрипт

. like any other chrome extension that has https and http access!
This includes extensions like AdBlock, ScriptSafe, Avast Online Security and due to the fact that it is not displayed explicitly when they are downloaded, any userscript that is installed as native Chrome extension.

If you’re interested in this, you can find the access information a the right column of every extension at the Chrome store by searching for «This extension can access».
Tampermonkey needs to be able to run at every page, because it doesn’t know at what pages your userscripts will run and therefore needs to be able to inject them into every page.

But you’re right, userscripts and extensions can harm your privacy and your computer. Nevertheless I think more evil is that Chrome does not display at what pages a userscript wants to run on when install it is installed as native extension. From this point of view TM even can bring you some security back, at least if you believe me, that I’m not interested in any of your data. If not, you can open the console (Ctrl-Shift-J) and choose the network tab to investigate what network communication is done. 🙂

Q301: Chrome says «Danger: Malware Ahead!». Is Tampermonkey infected with Malware?

No, Tampermonkey is not infected. Chrome shows this message because the options page tries to load a favicon from a page that Google suspects to be evil. So this just means that you have script installed that has such an malicious page in its @includes and Tampermonkey loads the favicons from there to give you an overview where your scripts will run.

Q302: How do I setup userscript-triggered downloads?

First, please notice that downloading files to your harddisk may be security relevant!
Malware might have an easy job once it is downloaded. So please make sure that you only allow the download of non-executable files.

Q303: Tampermonkey says one of my scripts is blacklisted. Why?

This happens cause you either added the source URL to the Manual Userscript and @require Blacklist or it was added to the list maintained by me. You can find the list including the reason for blackisting at the GitHub repo.

Q304: What permissions are necessary to run Tampermonkey and why?

Q305: I’m using Chrome and Tampermonkey keeps coming back after uninstallation. Why is this?