3 ms·
Nifty - but please do this more carefully: https://github.com/dnakov/little-rat/blob/main/popup.js#L36 https://github.com/dnakov/little-rat/blob/main/popup.js#
by horsawlarway 3y ago
Nifty - but please do this more carefully:
https://github.com/dnakov/little-rat/blob/main/popup.js#L36 https://github.com/dnakov/little-rat/blob/main/popup.js#L36
I do not want to have to worry about whether another extension can inject xss into yours with a crafted request/id/name.
- npace12 3y agothat is a very good point but: * the content security policy does not allow unsafe-inline * extension ids are autogenerated by chrome
- btown 3y agoWhile unsafe-inline prevents execution of scripts, it doesn't prevent another extension from including HTML in one of the URLs it is requesting, and adding DOM elements that might entirely change the display of the extension. Likely not a huge problem here (there are much easier ways to bypass/cheat this extension e.g. by inserting tracking code into the DOM of a visited page so it's executed by that page) but it's definitely not good practice to interpolate HTML with untrusted strings.
- deleted 3y ago[deleted]