4 ms·
> one of the key issue with the Chrome store is that it allows extensions with ability to execute remote code in extension context I agree. It is also "strongl
by itcrowd 7y ago
> one of the key issue with the Chrome store is that it allows extensions with ability to execute remote code in extension context
I agree. It is also "strongly recommended against" by the dev page [1]. Do you know a strong argument to allow usafe-eval? (i.e. what would be the rationale of continuing to allow it?)
[1] https://developer.chrome.com/extensions/contentSecurityPolicy#relaxing https://developer.chrome.com/extensions/contentSecurityPolic...
- vengefulduck 7y agoI bet it’s for user script extensions like tamper monkey.
- itcrowd 7y agoTamper monkey is also available for Firefox, which doesn't allow unsafe-eval .. [edit]: just checked, tamper monkey on chrome has the following policy: "content_security_policy": "script-src 'self' https://ssl.google-analytics.com; https://ssl.google-analytics.com; object-src 'self'"
- heavenlyblue 7y agoFirefox doesn’t allow plugins with unsafe-eval to their store.
- smilliken 7y agoIs it possible to prevent an extension from downloading a javascript payload and interpreting it? Eval isn't required.
- gorhill 7y agoThe default `script-src` policy in extensions is 'self', no JavaScript code outside the package will be allowed to execute.