Comment by aconst | Hacker News Reader

Comment by aconst | Hacker News Reader

Parent Full thread

The company I am working at develops a kind of overlay with helps that can be displayed on a given website. When we are lucky, our clients can add a script tag to their applications (and tweak their CSPs if they have), when we are not we have to rely on a web extension (think a kind of Tampermonkey but more specialized and with our branding and without a new tab every other day to tell it has been updated).

What do we use ?

- Blocking webRequest to change CSP to authorize our overlay script to execute

- executeScript: in most case, the script we execute is just inserting a script tag so it would still work in Manifest v3, but with webapps using Service Worker we have to resolve to download the scripts and execute then directly via executeScript, which will not be possible in v3.

Guess we'll have to bundle the overlay engine in the extension, which is much less flexible than what we had until now, but at least it's a possibility.

Original blog post author here. Some quick personal thoughts (i.e. I'm not speaking on behalf of Chrome here).

> - Blocking webRequest to change CSP to authorize our overlay script to execute

I can't exactly say I'm keen on extensions relaxing CSP rules for a site. The approach I'm interested in exploring here is allowing extension resources to bypass CSP restrictions on a given site. IMO a typical extension shouldn't be able to weaken a site's security, but it should be able to load its own images and scripts on the site.

> - executeScript: in most case, the script we execute is just inserting a script tag so it would still work in Manifest v3, but with webapps using Service Worker we have to resolve to download the scripts and execute then directly via executeScript, which will not be possible in v3.

This is not a viable approach in Manifest V3 as reviewers would consider this remote code injection and therefore a violation of the "Additional Requirements for Manifest V3" section of the policy.

https://developer.chrome.com/docs/webstore/program_policies/...

Bundling the overlay engine with the extension sounds like it may do the trick. Just make sure that the engine cannot be used for malicious purposes (e.g. harvesting user data, arbitrary script injection, etc.).

Reply on news.ycombinator.com