Mediapipe No Longer Compatible With Chrome Extensions

[nskaiser]

Hello,

We are unable to submit Chrome Extensions that use Mediapipe due to the new Manifest V3 requirement.

In manifest v3 the script-src directive in content_security_policy.extension_pages does not allow the use of "unsafe-eval" as mentioned here - https://developer.chrome.com/docs/extensions/mv3/mv3-migration/#content-security-policy

If "unsafe-eval" can't be specified for script-src then methods like eval() or Function(), which create functions from strings, are blocked as described here - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_eval_expressions

When we load https://cdn.jsdelivr.net/npm/@mediapipe/holistic/holistic_solution_wasm_bin.js there is a function called createNamedFunction() which uses new Function() to create functions by given name and body. Since "unself-eval" can't be specified for script-src directive then this method is blocked and an error is thrown.

I have spoken to the Google Chrome Store team and they will not make any exceptions to the Manifest V3 requirement.

Is this something that can be quickly addressed?

[ayushgdev]

Hello @nskaiser
Thanks for raising this issue. We do understand that chrome extensions are a popular requirement by community for MediaPipe as a platform. However, unsafe-eval is required by the solutions for the time being. We have received other issues in the past around the same requirements (#3458 , #3723 ). Post internal discussions, it was concluded that though this is possible on its own, it will have repercussions around the functionality of the MediaPipe solution. Hence this is not a priority right now.

[google-ml-butler]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you.

[tyrmullen]

A quick patch has been released for all utilities modules:

• drawing_utils (0.3.1675466124)
• control_utils_3d (0.3.1675466062)
• control_utils (0.6.1675466023)
• camera_utils (0.3.1675465971)

As well as the following JS solutions:

• hands (0.4.1675469240)
• pose (0.5.1675469404)
• holistic (0.5.1675471629)
• objectron (0.4.1675468480)
• selfie_segmentation (0.1.1675465747)

Hopefully this can address your issue; please let us know if that's not the case! Note that we were not yet able to update the remaining two JS solutions, so these will continue to have this issue:

• face_detection
• face_mesh

[google-ml-butler]

Closing as stale. Please reopen if you'd like to work on this further.

[google-ml-butler]

Are you satisfied with the resolution of your issue?
Yes
No