MV3 CSP Blocking Reddit media player

[benmcgarry]

Refused to load the script 'https://www.redditstatic.com/videoplayer.XCrwE8Bi5A4.js' because it violates the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' 'inline-speculation-rules'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

https://github.com/honestbleeps/Reddit-Enhancement-Suite/blob/master/lib/utils/pageContextScript.js

Stack trace points here:

Reddit-Enhancement-Suite/lib/modules/showImages.js

Lines 460 to 476 in 580e8ea

	module.onInit = () => {
	if (isAppType('r2')) {
	// We'll probably replace Reddit's video player, so disable the script containing it for now
	// This happens on `onInit` since RES' options load slower than the script's
	const preventVideoPlayerScriptTasks = [
	stopPageContextScript(script => (/^\/?videoplayer\./).test(new URL(script.src, location.origin).pathname), 'head', true),
	// Reddit loads scripts which initializes the video player, which will cause a slowdown if not blocked
	stopPageContextScript(script => !!script.innerHTML.match('RedditVideoPlayer'), PagePhases.contentStart.then(() => document.querySelector('#siteTable')), false),
	];
	loadOptions.then(() => {
	// We might need to restore the native player
	const removeNativePlayer = Modules.isRunning(module) && isSiteModuleEnabled(vreddit) && vreddit.options && vreddit.options.forceReplaceNativeExpando.value;
	if (!removeNativePlayer) forEachSeq(preventVideoPlayerScriptTasks, ({ undo }) => undo());
	});
	}
	};

[benmcgarry]

Appears https://github.com/honestbleeps/Reddit-Enhancement-Suite/blob/master/lib/modules/hosts/vreddit.js is pulling in a external script and MV3 doesnt allow that anymore.

[benmcgarry]

@larsjohnsen did we remove DASH js? 7fd526f#diff-56fcec0ae3a2599374d046db2cab20da5ffbd482ad4c6c8e609f9468eb550a08

[larsjohnsen]

No, but it it is added directly via build.js.

The onInit block in showImages had, as far as I can remember, no side effects other than some performance improvements, so I think we might as well remove it.

[benmcgarry]

Removing that onInit block may have fixed it... Not able to repro it anymore and no CSP error. It looks like Reddits advert block might have been messing with it.

[benmcgarry]

Looking at 507c0b2

I think its because theyve started to run ads through the same domain with a different player.