title: Loading an external script from within firefox extension
body: <p>I am currently rewriting a firefox extension to be used only internally at my company.  I started out by moving most of the logic into an external js file loaded via a script tag within the xul overlay.  (We've found it hard to get our employees to consistently upgrade so I thought I could get around that).  It worked fine like this:</p>
  
  <pre><code>&lt;overlay id="my-overlay"
   xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   xmlns:html="http://www.w3.org/1999/xhtml"&gt;
  &lt;script type="application/x-javascript" src="https://my.company.com/path/to/jquery.min.js/&gt;
  &lt;script type="application/x-javascript" src="https://my.company.com/path/to/toolbar/main.js"/&gt;
  
  &lt;toolbox id="navigator-toolbox"&gt; 
  
      &lt;!-- some stuff here --&gt;
  
  &lt;/toolbox&gt;
  </code></pre>
  
  <p></p>
  
  <p>But then I had the crazy idea of loading the script file dynamically so that I could use preferences to determine whether it would load from the production servers or alpha/beta servers.  And that's when I failed miserably.</p>
  
  <p>I've tried the following unsuccessfully:</p>
  
  <ul>
  <li>$.ajax({ dataType: 'script', ... }) // appears to do absolutely nothing</li>
  <li>$('overlay').appendChild('', { src: ... }) // script tag is added but not executed</li>
  <li><a href="https://developer.mozilla.org/en/XUL_School/Appendix_D%3a_Loading_Scripts#.3cscript.3e_tags" rel="nofollow">document.createElementNS, etc</a> // script tag is is added but not executed</li>
  <li>Components.utils.import // does not accept http protocol</li>
  <li>mozIJSSubScriptLoader // does not accept http protocol</li>
  </ul>
  
  <p>I haven't attempted <code>Components.utils.evalInSandbox</code> but given its restrictions, I'm afraid it would require significant other code changes that would not be worth the slight simplification of the development cycle.</p>
  
  <p>From reading thru much more mozilla documentation and bugs it appears that basically what I'm attempting to do is breaking various security concerns (I understand in principle but of course in my case, I have full control of both ends).</p>
  
  <p>The thing that bothers me is that it appears to work fine as long as I hard code the script tag but only fails once I try to dynamically generate it.  Should I just toss in the towel or does someone know a way to make this work?</p>