Replace functionality blocked by NS without whitelisting?

[thunderscript]

First of all I'd like to send my greetings to the forum regulars. So... Hi everyone!

I have a crazy(ish) idea about retaining some functionality of websites without whitelisting, and I guess I'm not the first. Do you know of a humanly feasible way not to whitelist the entire site, but merely replace their JavaScript with one provided from user-side? I'm talking about something similar to the surrogate technology Mister Giorgio had built into NS for google-analytics and similar trackers.

I'll explain with an actual example, so please bear with me. I frequent userstyles.org, place dedicated to changing how websites appear. In order to use it, one needs to whitelist userstyles.org. But I don't feel comfortable whitelisting a http-only website with primarily user-generated content. (They are also slow at applying software updates, security-fix releases!) I have checked their JS file (http://cdn.userstyles.org/javascripts/script.js) and it appears fine (with the excess of lightbox and such ).

Now, do you fine fellas know how to keep the site blocked in NS, but have it execute that JS file from my own hard-drive or other online source one can control? The only two ways I could figure out were... stopped... by NS. First idea was to use a local proxy to serve my own file and let Firefox think it fetched the real deal. Unfortunately, it fails if NoScript blocks scripts. Second idea was to use Greasemonkey / Scriptish and copy the relevant parts of JS there. That mostly works, but functionality is still too limited to install styles. Non-surprisingly, third and traditional way of executing external JS files (by embedding a script element to the page) is also blocked by NS.

I am hoping some of you have actually tried similar setups, or have an idea as to what would be the best way to accomplish it.
Eagerly awaiting your responses and input. Thank you for your time
Edit: fixed an error.

[Thrawn]

I believe surrogates can do this. They're more powerful than you might realise. Take a look at the Script Surrogate Quick Reference. However, you may need to copy the entire script (or the useful part) into about:config; you can't point NoScript to an external file.

[Giorgio Maone]

you can't point NoScript to an external file.

You can, actually. Rather than putting the code in the noscript.surrogate.xyz.replacement preference, put there a file:/// URL pointing at your local external script.

[thunderscript]

(...) in the noscript.surrogate.xyz.replacement preference, put there a file:/// URL pointing at your local external script.

Thank you both for your replies! I tried to follow instructions, but ended in failure. I created two string preferences:
noscript.surrogate.uso.replacement;file:///media/Drive/test.js
noscript.surrogate.uso.sources;!^http://userstyles\.org

userstyles.org website is not allowed to run scripts. I tried two different matching strings for .sources based on Thrawn's suggestion:
!^http://userstyles\.org and !http://userstyles.org/*

Local JS file contains just a simple alert("Surrogate script is loaded");

Nothing happens when I visit the site. Is a plain link (file:///media/Drive/test.js) enough to make it load the file, or do I need some more code? Is my matching correct, and which one?

Thank you for taking the time to help, I appreciate it.

[Thrawn]

you can't point NoScript to an external file.

You can, actually. Rather than putting the code in the noscript.surrogate.xyz.replacement preference, put there a file:/// URL pointing at your local external script.

Huh. I totally did not know that. Cool!

[江3如此多娇]

You can, actually. Rather than putting the code in the noscript.surrogate.xyz.replacement preference, put there a file:/// URL pointing at your local external script.

That sounds great! It is similar to Local Load, which has not been updated for a long time~
Hope you can give some practical or detailed suggestions or guidelines

[access2godzilla]

Loading of surrogates from a file reportedly doesn't work. But sticking the source in the file still works.

[thunderscript]

But I don't feel comfortable whitelisting a http-only website with primarily user-generated content. (They are also slow at applying software updates, security-fix releases!)

Turns out I wasn't just being paranoid. They got hacked a week ago.

Loading of surrogates from a file reportedly doesn't work. But sticking the source in the file still works.

Thanks, though I figured that out in the mean time.