3 ms·

You can't insert tag into webpage? I'm confused.

• lzaaz 4y ago
  Quite literally yes. It would've killed GreaseMonkey userscripts and such
  • vbezhenar 4y ago
    According to my little research you can insert script tags, but you can only use the scripts which are bundled inside the extension. It's still not clear to me what prevents this script to download external script using AJAX which will execute whatever user wants (e.g. some cloud userscript service). Also for power users it should not be a problem at all. Just create your own extension which is literally few simple files and put your userscripts inside that extension. Then load this extension from the chrome and voila.
    • oefrha 4y ago
      > It's still not clear to me what prevents this script to download external script using AJAX which will execute whatever user wants If you read the MV3 migration guide you’ll quickly realize why. CSP script-src is restricted to self, none, or localhost sources for all non-sandbox pages, content scripts included. https://developer.chrome.com/docs/extensions/mv3/mv3-migration/#content-security-policy https://developer.chrome.com/docs/extensions/mv3/mv3-migrati...
      • vbezhenar 4y ago
        I don't think that's what I'm talking about. I'm talking about inserting a script from the extension which will then download another script from the external source and execute it. Once you've got access to the DOM, you're pretty much unstoppable.
        • oefrha 4y ago
          No, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.
          • vbezhenar 4y ago
            You still can just write your userscript as an extension. I just checked - it works. I inserted script into HN and did some stuff.
            • oefrha 4y ago
              I never said you can’t.
          • mh- 4y ago
            Since one of the parent comments mentioned AJAX, I'll add that you'll also be prevented from eval'ing that payload.
            • oefrha 4y ago
              Yes, I should have been more clear: CSP doesn’t allow you to download an external script and execute it, which requires unsafe-eval.
              • TeMPOraL 4y ago
                Sounds like your exception will need to become a language interpreter itself.
                • TOMDM 4y ago
                  Does manifest v3 support wasm? Time to package a JavaScript interpreter into wasm and run it within the extension.
          • vbezhenar 4y ago
            Can you pass data between script and extension? Implementing JS or lua should be possible.
• btown 4y ago
  The entire meta-point of MV3 is, ostensibly for consumer protection, to prevent extension authors from dynamically executing code that has not been reviewed by Google’s review process, as well as from executing code synchronously to choose to block a network request. Of course, userscripts are dynamic code not delivered as part of the extension itself. And so are effective ad blockers - when one side of an arms race is fundamentally limited from running code, it becomes open season for the other. The conflict of interest left a foul taste in many people’s mouths.