Hacker News Reader

Comment by Daviey | Hacker News Reader

Thanks for sharing, would you mind explaining how it works and if there are any general concerns you have with Chrome not sandboxing between extensions? ie, what else is shared between extensions and what risks do you feel are here.

Thanks

View on HN

The key code is here: https://github.com/dnakov/little-rat/blob/f0b9b6be39af9fe7f4...

  chrome.declarativeNetRequest.onRuleMatchedDebug.addListener((e) => {
    if (e.request.initiator?.startsWith('chrome-extension://')) {

Given that the extension is using a "Debug" API, it seems unlikely that the Chrome Web Store will approve. "Only available for unpacked extensions with the declarativeNetRequestFeedback permission as this is intended to be used for debugging purposes only." https://developer.chrome.com/docs/extensions/reference/decla...

Yeah, that's correct. The extension loads a rules_1.json file that just "allow"s all traffic originating from third-party scripts through, then logs just the URL of each request coming from a chrome extension. There's probably a way to do this with chrome.webRequest, I'll experiment with that, but generally that one is more expensive in terms of performance.

> There's probably a way to do this with chrome.webRequest

Network requests initiated by other extensions in their own context are not visible to other extensions through the webRequest API.

Damn, I was gonna go research it just in case, but then I noticed who posted this. Mad respect for your work!

Reply on news.ycombinator.com