GoogleChrome / GoogleChrome/chrome-extensions-samples
chrome.scripting.executeScript allFrames doesn't resolve on CSP-restrictive pages.
- Dominant language
- JavaScript
- Stars
- 17.8k
- Forks
- 9k
- Avg merge
- 21h
- Merged PRs (30d)
- 28
Description
**Describe the bug**
`chrome.scripting.executeScript` callback is never called (if using promises, the promise never resolves) when the page in which it's executed contains iframe with certain CSP headers that seem restrictive / safer.
**To Reproduce**
```
// background.js
chrome.action.onClicked.addListener((tab) => {
console.log('click');
chrome.scripting.executeScript(
{
target: {
tabId: tab.id,
allFrames: true,
},
'func': function() {
return document.activeElement;
},
'args': [],
},
(...args) => {console.log('callback', args)});
});
// manifest.json
{
"name": "Test executeScript",
"description": "",
"version": "0.0.1",
"manifest_version": 3,
"permissions": [
"scripting"
],
"background": {
"service_worker": "bg.js"
},
"action": {},
"minimum_chrome_version": "93.0.0.0",
}
```
And then click the extension icon on a site like https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input
**Expected behavior**
The Promise should throw or the callback should be called.
** Notes**
I'm suspicious of Content Security Policy but I did not try using Charles (or similar proxy) to override header by header to know which one is messing up the extension. This may even be a bug using MV2, [Chrome Input Tools](https://chrome.google.com/webstore/detail/google-input-tools/mclkkofklkfljcocdinagocijmpgbhab) also doesn't work on the Mozilla site.
Contributor guide
Assessment
This issue has not been assessed yet.