4 ms·

Interacting with the page as if your code would have been loaded by the page is only possible if you inject your code in the page context, typically using a scr

Interacting with the page as if your code would have been loaded by the page is only possible if you inject your code in the page context, typically using a script tag in Chrome, at which point you are governed by the CSP restrictions of the page. You either relax those restrictions in some way, or you can't run your code in the JS context of the page. It's possible to run code in a content script regardless of how restrictive the pages's CSP headers are, but you are running in an isolated environment that can only access the page DOM.

vbezhenar 5y ago
Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?
- deleted 5y ago
  [deleted]
- Ajedi32 5y ago
  YouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
- deleted 5y ago
  [deleted]
- rini17 5y ago
  GitHub
- qvq 5y ago
  For a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP. For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP. Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
- g3rv4 5y ago
  slack. I do so with my extension[0]. At one point they rewrote it and added CSP. In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private. After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it. [0] https://refined.chat https://refined.chat

vbezhenar 5y ago

Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?

deleted 5y ago
[deleted]
Ajedi32 5y ago
YouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
deleted 5y ago
[deleted]
rini17 5y ago
GitHub
qvq 5y ago
For a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP. For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP. Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
g3rv4 5y ago
slack. I do so with my extension[0]. At one point they rewrote it and added CSP. In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private. After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it. [0] https://refined.chat https://refined.chat