7 ms·
Quite literally yes. It would've killed GreaseMonkey userscripts and such
by lzaaz 4y ago
Quite literally yes. It would've killed GreaseMonkey userscripts and such
- vbezhenar 4y agoAccording to my little research you can insert script tags, but you can only use the scripts which are bundled inside the extension. It's still not clear to me what prevents this script to download external script using AJAX which will execute whatever user wants (e.g. some cloud userscript service). Also for power users it should not be a problem at all. Just create your own extension which is literally few simple files and put your userscripts inside that extension. Then load this extension from the chrome and voila.
- oefrha 4y ago> It's still not clear to me what prevents this script to download external script using AJAX which will execute whatever user wants If you read the MV3 migration guide you’ll quickly realize why. CSP script-src is restricted to self, none, or localhost sources for all non-sandbox pages, content scripts included. https://developer.chrome.com/docs/extensions/mv3/mv3-migration/#content-security-policy https://developer.chrome.com/docs/extensions/mv3/mv3-migrati...
- vbezhenar 4y agoI don't think that's what I'm talking about. I'm talking about inserting a script from the extension which will then download another script from the external source and execute it. Once you've got access to the DOM, you're pretty much unstoppable.
- oefrha 4y agoNo, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.
- vbezhenar 4y agoYou still can just write your userscript as an extension. I just checked - it works. I inserted script into HN and did some stuff.
- oefrha 4y agoI never said you can’t.
- mh- 4y agoSince one of the parent comments mentioned AJAX, I'll add that you'll also be prevented from eval'ing that payload.
- oefrha 4y agoYes, I should have been more clear: CSP doesn’t allow you to download an external script and execute it, which requires unsafe-eval.
- vbezhenar 4y agoCan you pass data between script and extension? Implementing JS or lua should be possible.
- horsawlarway 4y agoYes - I have done this in an MV3 extension. You can basically re-implement your own runtime and download the code and run it there instead of using eval/script tags. It's very inefficient and it's a pain to write, but it is possible. I suspect they will not approve extensions that do this if it becomes popular.