3 ms·
Thanks for sharing, would you mind explaining how it works and if there are any general concerns you have with Chrome not sandboxing between extensions? ie, wh
by Daviey 3y ago
Thanks for sharing, would you mind explaining how it works and if there are any general concerns you have with Chrome not sandboxing between extensions? ie, what else is shared between extensions and what risks do you feel are here.
Thanks
- lapcat 3y agoThe key code is here: https://github.com/dnakov/little-rat/blob/f0b9b6be39af9fe7f4260604baccbc1ebd4d470e/service-worker.js#L31 https://github.com/dnakov/little-rat/blob/f0b9b6be39af9fe7f4... chrome.declarativeNetRequest.onRuleMatchedDebug.addListener((e) => { if (e.request.initiator?.startsWith('chrome-extension://')) { Given that the extension is using a "Debug" API, it seems unlikely that the Chrome Web Store will approve. "Only available for unpacked extensions with the declarativeNetRequestFeedback permission as this is intended to be used for debugging purposes only." https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/#event-onRuleMatchedDebug https://developer.chrome.com/docs/extensions/reference/decla...
- npace12 3y agoYeah, that's correct. The extension loads a rules_1.json file that just "allow"s all traffic originating from third-party scripts through, then logs just the URL of each request coming from a chrome extension. There's probably a way to do this with chrome.webRequest, I'll experiment with that, but generally that one is more expensive in terms of performance.
- gorhill 3y ago> There's probably a way to do this with chrome.webRequest Network requests initiated by other extensions in their own context are not visible to other extensions through the webRequest API.
- npace12 3y agoDamn, I was gonna go research it just in case, but then I noticed who posted this. Mad respect for your work!