More on DataSpii: How extensions hide their grabs and how they’re discovered

Re:More on DataSpii: How extensions hide their grabs and how... by itcrowd on Thursday July 18, 2019 @01:07PM (#20471840)

> one of the key issue with the Chrome store is that it allows extensions with ability to execute remote code in extension context

I agree. It is also "strongly recommended against" by the dev page [1]. Do you know a strong argument to allow usafe-eval? (i.e. what would be the rationale of continuing to allow it?)

[1] https://developer.chrome.com/extensions/contentSecurityPolic...

[ Parent | on HN ]

Re:More on DataSpii: How extensions hide their grabs and how... by vengefulduck on Thursday July 18, 2019 @01:25PM (#20472024)

I bet it’s for user script extensions like tamper monkey.

[ Parent | on HN ]

Re:More on DataSpii: How extensions hide their grabs and how... by itcrowd on Thursday July 18, 2019 @01:30PM (#20472084)

Tamper monkey is also available for Firefox, which doesn't allow unsafe-eval ..

[edit]: just checked, tamper monkey on chrome has the following policy:

"content_security_policy": "script-src 'self' https://ssl.google-analytics.com; object-src 'self'"

[ Parent | on HN ]

Re:More on DataSpii: How extensions hide their grabs and how... by heavenlyblue on Thursday July 18, 2019 @01:54PM (#20472303)

Firefox doesn’t allow plugins with unsafe-eval to their store.

[ Parent | on HN ]

Re:More on DataSpii: How extensions hide their grabs and how... by smilliken on Thursday July 18, 2019 @02:35PM (#20472717)

Is it possible to prevent an extension from downloading a javascript payload and interpreting it? Eval isn't required.

[ Parent | on HN ]

Re:More on DataSpii: How extensions hide their grabs and how... by gorhill on Thursday July 18, 2019 @03:24PM (#20473118)

The default `script-src` policy in extensions is 'self', no JavaScript code outside the package will be allowed to execute.

[ Parent | on HN ]