4 ms·

What are some use cases for interacting with other scripts, instead of interacting with the DOM? I suppose that if you want to disable some behavior in the web

What are some use cases for interacting with other scripts, instead of interacting with the DOM? I suppose that if you want to disable some behavior in the website (to insert your own extension's before letting the website's own execute) you have to do that... But when would you want to do that?

dessant 5y ago
When you want to hook into page functionality and extend it. For example, extensions for YouTube will routinely access the JS objects of the page and listen to player events in order to introduce new features. This is only possible if you run your code in the context of the page.
- viraptor 5y ago
  You can add new scripts to the page though. You don't have to interfere with the existing scripts / change them. That doesn't break CSP if you do it the right way.
  - dessant 5y ago
    Interacting with the page as if your code would have been loaded by the page is only possible if you inject your code in the page context, typically using a script tag in Chrome, at which point you are governed by the CSP restrictions of the page. You either relax those restrictions in some way, or you can't run your code in the JS context of the page. It's possible to run code in a content script regardless of how restrictive the pages's CSP headers are, but you are running in an isolated environment that can only access the page DOM.
    - vbezhenar 5y ago
      Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?
      - deleted 5y ago
        [deleted]
      - Ajedi32 5y ago
        YouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
      - deleted 5y ago
        [deleted]
      - rini17 5y ago
        GitHub
      - qvq 5y ago
        For a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP. For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP. Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
      - g3rv4 5y ago
        slack. I do so with my extension[0]. At one point they rewrote it and added CSP. In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private. After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it. [0] https://refined.chat https://refined.chat
d110af5ccf 5y ago
Adblockers often inject anti-anti-adblocking scripts. AFAIK, these are often drop-in replacements and so need to communicate with other scripts in the same way as the original.

dessant 5y ago

When you want to hook into page functionality and extend it. For example, extensions for YouTube will routinely access the JS objects of the page and listen to player events in order to introduce new features. This is only possible if you run your code in the context of the page.

viraptor 5y ago
You can add new scripts to the page though. You don't have to interfere with the existing scripts / change them. That doesn't break CSP if you do it the right way.
- dessant 5y ago
  Interacting with the page as if your code would have been loaded by the page is only possible if you inject your code in the page context, typically using a script tag in Chrome, at which point you are governed by the CSP restrictions of the page. You either relax those restrictions in some way, or you can't run your code in the JS context of the page. It's possible to run code in a content script regardless of how restrictive the pages's CSP headers are, but you are running in an isolated environment that can only access the page DOM.
  - vbezhenar 5y ago
    Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?
    - deleted 5y ago
      [deleted]
    - Ajedi32 5y ago
      YouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
    - deleted 5y ago
      [deleted]
    - rini17 5y ago
      GitHub
    - qvq 5y ago
      For a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP. For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP. Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
    - g3rv4 5y ago
      slack. I do so with my extension[0]. At one point they rewrote it and added CSP. In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private. After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it. [0] https://refined.chat https://refined.chat

d110af5ccf 5y ago

Adblockers often inject anti-anti-adblocking scripts. AFAIK, these are often drop-in replacements and so need to communicate with other scripts in the same way as the original.