3 ms·
You can't eval in extension context, but injecting a <script> would work given the permission that lets you edit the page's DOM.
by cmeacham98 6y ago
You can't eval in extension context, but injecting a <script> would work given the permission that lets you edit the page's DOM.
- davidzweig 6y agoAh, thought it was allowed with 'unsafe-eval' in extension CSP. Never had a need for it. Remote code refers to injecting <script> tags into the page then?
- josteink 6y agoWhen running as a WebExtension you have a higher set of permissions than a regular script (you can to some degree control the browser, after all), so certain parts of JavaScript is off-limits. eval() is one of those things.