How to allow eval in chrome extension version 3

user_419425 0
Viewed 2680

I'm upgrading my chrome extension to manifest version 3. But, my extension uses eval in its content script. In version 3 I get the following error

Error in event handler: EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

I was able to fix this in version 2 as follows:

 "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

But this has changed and I tried many things

"content_security_policy": {
    "script-src": "self unsafe-eval",
    "unsafe-eval": "object-src self",
    "unsafe-inline": "self"
}

I'm not sure what exactly is possible here, so any help would be appreciated

google-chrome-extension javascript
2 Answers

See if you can bypass it whith Function( "return "+ toBeEvaluated )() constructor; If that's blacklisted too see if they left setTimeout( toBeEvaluated, 1 ) out. That would work as a substitution too.

But this fix is no avail - we need to fix the problem at its source. Need to fix the superstition surrounding the eval command. People need to stop being afraid of power.

user_58964260

using eval or any other ways like new Function to execute code from a string is not supported in Manifest v3. It's against their updated policy. Manifest V3 does not allow arbitrary code execution.

ref: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-migration/#remotely-hosted-code

However, a spokesperson from Google confirmed that they plan to support userscript managers (which depend on arbitrary code execution) in Manifest V3 before the Manifest V2 deprecation. Most likely end-user would need to enable some setting in order to allow the extension to run arbitrary code.

ref: https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-1140110430

user_30732720
Related