Improvements to messaging article. #4275
Conversation
✅ Deploy Preview for developer-chrome-com ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
| @@ -265,7 +271,7 @@ scripts. | |||
| When receiving a message from a content script or another extension, your scripts should be careful | |||
| not to fall victim to [cross-site scripting][39]. This advice applies to scripts running inside the | |||
| extension background page as well as to content scripts running inside other web origins. | |||
| Specifically, avoid using dangerous APIs such as the ones below: | |||
| Specifically, avoid using dangerous APIs, specificaslly `chrome.scripting.executeScript()`, `eval()`, and `new Function()`. For example: | |||
There was a problem hiding this comment.
This section is a bit odd now because of CSP changes in Manifest V3. Ian is working on #3837 to update our CSP docs, but the short version is that Chrome has a minimum CSP for extension contexts that does not allow developers to call eval() or new Function(). For reference, the minimum CSP is script-src 'self' 'wasm-unsafe-eval'; object-src 'self';.
It may be best to use a slightly different approach for this section. Since cross-site scripting isn't as much a concern, we could lean into "cross-site attacks," where a compromised render could use the message channel to send the extension messages in order to extract data or make the extension do something dangerous.
Cross-site scripting is still a concern for content scripts. This is another method by which a content script could potentially be hijacked into sending dangerous messages back to the extension.
There was a problem hiding this comment.
I'm going to remove the new text so that we can merge this. I'll circle back when I have more information.
Co-authored-by: Simeon Vincent <[email protected]>
Co-authored-by: Simeon Vincent <[email protected]>
There was a problem hiding this comment.
@jpmedley Good improvements.
Since you are making this article MV3 compatible, can you change the mention of background pages to extension service worker?
For example, an RSS reader extension might use content scripts to detect the presence of an RSS feed on a page, then notify the background page in order to display a page action icon for that page.
This sentence mentions a background page and a page action. Both are not supported in MV3.
|
@dotproto, I've removed the bit about PTAL |
Co-authored-by: amysteamdev <[email protected]>
Co-authored-by: amysteamdev <[email protected]>
Co-authored-by: amysteamdev <[email protected]>
|
@jpmedley Nope, I think this can be merged as is 👍 |
| console.log(response.farewell); | ||
| }); | ||
| chrome.tabs.query({active: true, lastFocusedWindow: true}, function(tabs) { | ||
| await response = chrome.tabs.sendMessage(tabs[0].id, {greeting: "hello"}); |
| chrome.runtime.sendMessage({greeting: "hello"}, function(response) { | ||
| console.log(response.farewell); | ||
| }); | ||
| await response = chrome.runtime.sendMessage({greeting: "hello"}); |
There was a problem hiding this comment.
Thank you for your feedback. We had an off day there.
See #4518
|
Fixing the snippets is a little tricky because you need to show a complete The first snippet: (async () => {
const response = await chrome.runtime.sendMessage({greeting: "hello"});
// do something with response here, not outside the function
console.log(response);
})();The second snippet should be rewritten: (async () => {
const [tab] = await chrome.tabs.query({active: true, lastFocusedWindow: true});
const response = await chrome.tabs.sendMessage(tab.id, {greeting: "hello"});
// do something with response here, not outside the function
console.log(response);
})();Generally you should convert all Also make sure to at least verify each JS snippet you modify or add in devtools console, especially if JS is not your forte. |
|
We know that. I had an off day. |
@dotproto, I realized this morning that I needed to understand messaging better. If I'm reading something, the cost of improving it is marginal. I made some V3-specific updates to this article. You can find them at lines 27, 33, 43, and 274. Please ignore the other stuff. I'll ask @AmySteam to do a proper copy edit before I merge.
Staged link
Message passing