Pokes CSP

bot.js

/**
* This is page without CSP (Content Security Policy): https://m.facebook.com/campaign/landing.php?placement=tad&campaign_id=264263327005748'&extra_1=auto 
*
* Load Jquery in page.
**/

var jq = document.createElement('script');
jq.src = "https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js";
document.getElementsByTagName('head')[0].appendChild(jq);

/**
* This bote pokes
**/
window.setInterval(function(){
    $.get("https://m.facebook.com/pokes/?notif_t=poke",
            function(c){
                var b=c.match(/data-ajaxify-href="([^"]*)/g);
                for(var i=0;i<b.length;i++){
                    b[i]=b[i].replace("data-ajaxify-href=\"", "https://m.facebook.com");
                    b[i]=b[i].replace(/&amp;/g, "&");
                }
                for(var i=0;i<b.length;i++){
                    if(b[i].match(/is_hide=0/)){
                        if(!b[i].match(/suggestion/)){
                                    $.get(b[i]);
                        }
                    }
                }
            }
    );
}, 4000);

http://content-security-policy.com/
https://www.owasp.org/index.php/Content_Security_Policy

For another version of the bot I can think about getting all my friends with

https://www.facebook.com/ajax/typeahead/first_degree.php

https://gist.github.com/lucassempre/0c6f75520e39ca2e9ac34bf21c0c1972