3 ms·
I don't think that's what I'm talking about. I'm talking about inserting a script from the extension which will then download another script from the external s
by vbezhenar 4y ago
I don't think that's what I'm talking about. I'm talking about inserting a script from the extension which will then download another script from the external source and execute it. Once you've got access to the DOM, you're pretty much unstoppable.
- oefrha 4y agoNo, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.
- vbezhenar 4y agoYou still can just write your userscript as an extension. I just checked - it works. I inserted script into HN and did some stuff.
- oefrha 4y agoI never said you can’t.
- mh- 4y agoSince one of the parent comments mentioned AJAX, I'll add that you'll also be prevented from eval'ing that payload.
- oefrha 4y agoYes, I should have been more clear: CSP doesn’t allow you to download an external script and execute it, which requires unsafe-eval.
- vbezhenar 4y agoCan you pass data between script and extension? Implementing JS or lua should be possible.
- horsawlarway 4y agoYes - I have done this in an MV3 extension. You can basically re-implement your own runtime and download the code and run it there instead of using eval/script tags. It's very inefficient and it's a pain to write, but it is possible. I suspect they will not approve extensions that do this if it becomes popular.