3 ms·
Um, question, does remote code (as defined by the Webstore and Mozilla) refer to JS that is downloaded and eval()ed in the background and content script context
by davidzweig 6y ago
Um, question, does remote code (as defined by the Webstore and Mozilla) refer to JS that is downloaded and eval()ed in the background and content script contexts, or <script> tags that are injected into the page, or both?
- cmeacham98 6y agoYou can't eval in extension context, but injecting a <script> would work given the permission that lets you edit the page's DOM.
- davidzweig 6y agoAh, thought it was allowed with 'unsafe-eval' in extension CSP. Never had a need for it. Remote code refers to injecting <script> tags into the page then?
- josteink 6y agoWhen running as a WebExtension you have a higher set of permissions than a regular script (you can to some degree control the browser, after all), so certain parts of JavaScript is off-limits. eval() is one of those things.