Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use tabs.executeScript() instead of import() #62

Open
WofWca opened this issue May 31, 2022 · 0 comments
Open

Use tabs.executeScript() instead of import() #62

WofWca opened this issue May 31, 2022 · 0 comments

Comments

@WofWca
Copy link
Owner

WofWca commented May 31, 2022

Maybe.
Using dynamic imports makes us have to add web_accessible_resources:

"web_accessible_resources": [
"content/SilenceDetectorProcessor.js",
"content/VolumeFilterProcessor.js",
"chunks/*.js"
],
, which is not ideal, as I heard: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/web_accessible_resources#security
It's also a little dangerous to not have the import URL set in stone, maybe it could be somehow manipulated by a malicious page to import something else on behalf of the extension (Mozilla's web-ext warns about this).
`const urlAbsolute = (typeof browser === 'undefined' ? chrome : browser).runtime.getURL(url)`,

Edit: Actually this doesn't look super dangerous, since we're passing the string through runtime.getURL(,

But then, it sounds a little stupid that there's virtually no native support for dynamic importing in extensions. Or am I missing something?

Another big thing is with .audioWorklet.addModule:

const addWorkletProcessor = (url: string) => audioContext.audioWorklet.addModule(browser.runtime.getURL(url));
For it we can't do executeScript(). Maybe the spec needs to be changed. I don't know what's the best practice.

This may also help with #26

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant