GoogleChrome / GoogleChrome/chrome-extensions-samples

chrome.scripting.executeScript allFrames doesn't resolve on CSP-restrictive pages.

Open
#715 11 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
17.8k
Forks
9k
Avg merge
21h
Merged PRs (30d)
28

Description

**Describe the bug**
`chrome.scripting.executeScript` callback is never called (if using promises, the promise never resolves) when the page in which it's executed contains iframe with certain CSP headers that seem restrictive / safer.

**To Reproduce**
```
// background.js
chrome.action.onClicked.addListener((tab) => {
console.log('click');

chrome.scripting.executeScript(
{
target: {
tabId: tab.id,
allFrames: true,
},
'func': function() {
return document.activeElement;
},
'args': [],
},
(...args) => {console.log('callback', args)});
});

// manifest.json
{
"name": "Test executeScript",
"description": "",
"version": "0.0.1",
"manifest_version": 3,
"permissions": [
"scripting"
],
"background": {
"service_worker": "bg.js"
},
"action": {},
"minimum_chrome_version": "93.0.0.0",
}
```

And then click the extension icon on a site like https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input

**Expected behavior**
The Promise should throw or the callback should be called.

** Notes**
I'm suspicious of Content Security Policy but I did not try using Charles (or similar proxy) to override header by header to know which one is messing up the extension. This may even be a bug using MV2, [Chrome Input Tools](https://chrome.google.com/webstore/detail/google-input-tools/mclkkofklkfljcocdinagocijmpgbhab) also doesn't work on the Mozilla site.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.