Chrome extension manifest v3 and inline scripts

user_16348464 0
Viewed 1197

Building a chrome extension. I need to add scripts inside pages for redeclaring predefined functions (like fetch() for example). Scripts to be loaded are part of the extension files. What I did before is just load scripts over tag included to page. Now when I try I have this:

Refused to execute inline script because it violates the following 
Content Security Policy directive: "script-src 'self'". 
Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') 
is required to enable inline execution.

Tried to add this to the manifest

"content_security_policy": {
  "extension_pages": "script-src 'self' 'sha256-...",
  "sandbox": "none"
}

and got error:

Insecure CSP value "'sha256-...'" in directive 'script-src'.

and same with "nonce-" or "unsafe-inline", they all are named as insecure, and I can't load manifest with such policy. So what should I do now with manifest v3?

content-security-policy google-chrome-extension javascript
2 Answers

content_security_policy's "sha-.." "nonce-.." and "unsafe-inline" workarounds are no longer valid in manifest 3

user_27525950

Hm. And why did not I get myself? Yes, I can just add those scripts as files, not their inline content. Thanks for help wOxxOm

user_163484640
Related