Support Web Extension Manifest V3

[kaya51]

Is your feature request related to a problem? Please describe.

If I'm not mistaken magick-wasm can't be used in a MV3 (Manifest Version 3) extension, at least on Chrome.

If you try to use it, it's gonna give an error like this.

Uncaught (in promise) EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' 'inline-speculation-rules' http://localhost:* http://127.0.0.1:*".

I believe it gives that error because of this and this. Function is an unsafe expression according to here.

What I understand is it needs 'unsafe-eval' in content_security_policy.extension_pages, but it can't have that in MV3.

https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy

The extension_pages policy cannot be relaxed beyond this minimum value. In other words, you cannot add other script sources to directives, such as adding 'unsafe-eval' to script-src. If you add a disallowed source to your extension's policy, Chrome will throw an error like this at install time:
'content_security_policy.extension_pages': Insecure CSP value "'unsafe-eval'" in directive 'script-src'.;

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy#examples

Manifest V3 does not allow 'unsafe-eval' in script-src.

I've prepared some examples for both MV2 and MV3. They are designed to work as expected in the current up to date Chrome. I didn't check the API's for minimum version of Chrome. MV2 ones might require ExtensionManifestV2Availability or equilevent. They go step by step.

1. An empty extension
2. Tries to use magick-wasm
3. Adds wasm-unsafe-eval
4. Adds unsafe-eval

In MV2, it works fine at step 4. I think this proves I do nothing wrong in MV3. That's just the way it is.

Describe the solution you'd like

Implementation of the relevant functions in an alternative way.

Describe alternatives you've considered

No response

Additional context

No response

[kaya51]

I don't know if it's worth mentioning, I believe the problem in #187 is/was mv2-2 or mv3-2.

[dlemstra]

I think a better approach we be if I could avoid using those unsafe-eval's. I would rather remove them instead. This would probably also resolve the cloud-flare issues that where mentioned in #195. How did you figure out what caused it? Is that something that can be automated?

[kaya51]

How did you figure out what caused it?

Chrome gives you the stack trace, although I realized it after spending some time. I was focused on the first screenshot.

I tried to figure out what this is. I used unknownFunctionName and searched your GitHub profile. Found this. Found the "Function" in the file. For the other occurrence in index.js, I searched methodCaller< in the repo and found it.

I realized that I pushed the commented code by mistake because I was trying to figure out what it was.

Is that something that can be automated?

I don't know. Maybe using proxy?

[kaya51]

I don't know. Maybe using proxy?

I added kaya51/wasm-examples@815e623 as an example.

[dlemstra]

Would it also be possible to analyze the code at "compile time" instead of at run time?

[kaya51]

Would it also be possible to analyze the code at "compile time" instead of at run time?

I don't know. I don't even know what you mean by "compile time". I don't write TypeScript, have never tried to compile WASM file before. I was digging but then found this repo.

If you're talking about TS tests, it looks like ESLint and its security plugin has some stuff. I don't know if it covers this situation.

[kaya51]

What do you think about this? @dlemstra

emscripten-core/emscripten#20994

[dlemstra]

Thanks for mentioning that issue. I changed the build of the wasm library and added the options mentioned there. All the unit tests of this projects are still passing. Can you give it a try locally? What you could do is download the artifacts on the latest build and replace the files in the node_modules folder and then build your application. And if you can confirm this works I can publish a new release that includes this change.

[kaya51]

I updated the mv3-3 and it works like a charm. Thank you.

[kaya51]

I thougth you would close the issue when you published it. Maybe you forgot, or you think it's not solved. I'm closing it as completed. If you think it's a mistake, please revert it.
Thanks again.