Re:Chrome extensions are tampering with security headers
by vbezhenar on Wednesday May 26, 2021 @06:56AM
(#27288836)
Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?
Re:Chrome extensions are tampering with security headers
by qvq on Thursday May 27, 2021 @01:17AM
(#27299647)
For a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP.
For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP.
Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
Re:Chrome extensions are tampering with security headers
by Ajedi32 on Wednesday May 26, 2021 @11:20AM
(#27291662)
YouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
Re:Chrome extensions are tampering with security headers
by g3rv4 on Thursday May 27, 2021 @11:07PM
(#27311312)
slack. I do so with my extension[0]. At one point they rewrote it and added CSP.
In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private.
After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it.
You either relax those restrictions in some way, or you can't run your code in the JS context of the page.
It's possible to run code in a content script regardless of how restrictive the pages's CSP headers are, but you are running in an isolated environment that can only access the page DOM.