Chrome Extension blocks programmatic request to popup.html - google-chrome-extension

After the release of Chrome 66, our specs for testing a Chrome Extension fail because we are unable to access the popup.html programmatically because the request to chrome-extension://<extension-id>/src/popup.html is blocked.
We've tried getting the extension ID programmatically using chrome.runtime.id and chrome.runtime.getURL().
We've also tried generating our own PEM to sign the extension and using the generated ID in the manifest as the extension key. Both of these attempts have proved fruitless.
Is there still a way to access Chrome Extension programmatically for testing?
Update: Here is my manifest.json:
{
"manifest_version": 2,
"name": "Paparazzi",
"version": "1.0.9",
"background": {
"matches": ["<all_urls>"],
"scripts": [
"src/background.js",
"vendor/jszip.js",
"vendor/FileSaver.js",
"vendor/mixpanel.js"
]
},
"browser_action": {
"default_icon": {
"16": "ic-paparazzi-16.png",
"48": "ic-paparazzi-48.png",
"96": "ic-paparazzi-96.png",
"128": "ic-paparazzi-128.png",
"256": "ic-paparazzi-256.png"
},
"default_popup": "src/popup.html"
},
"commands": {
"capture_screen": {
"suggested_key": {
"default": "Ctrl+Shift+E",
"mac": "Command+Shift+E"
},
"description": "Capture screenshot of current tab"
}
},
"content_security_policy":
"script-src 'self' https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js; object-src 'self'",
"icons": {
"16": "ic-paparazzi-16.png",
"48": "ic-paparazzi-48.png",
"96": "ic-paparazzi-96.png",
"128": "ic-paparazzi-128.png",
"256": "ic-paparazzi-256.png"
},
"permissions": [
"activeTab",
"cookies",
"identity",
"identity.email",
"notifications",
"tabCapture",
"tabs",
"webRequest",
"webRequestBlocking",
"http://*/",
"*://*.sharethrough.com/*",
"*://localhost/*",
"<all_urls>"
],
"web_accessible_resources": [
"src/*",
"vendor/fonts/MetricWeb-Regular.woff",
"vendor/bootstrap.min.css"
],
"key": "bgcanlbkmndllogdnbohopfomoknmjmf"
}

I'm on Chrome 66.0.3359.117 and I was able to get files like this;
chrome.runtime.getURL("popups/popup.html");
window.open() succeed for getting it to open the page. It does not work when the folder or file is not specified under "web_accessible_resources".
"web_accessible_resources": [
"popups/*"
]
If the problem isn't with the manifest, then it's likely related to the testing software and not Chrome.

Related

Why is the background script not loading on Firefox add-on (works on Chrome)?

I'm developing a cross-browser extension which works in Chrome but not in Firefox - the background script is not loading.
I tried console.log in background.js and sending a message to the content script and logging message there.
background.js
browser.action.onClicked.addListener(async function (tab) {
console.log("clicked on extension icon");
browser.tabs.sendMessage(tab.id, { text: "toggle_overlay" })
});
js/content.js
...
browser.runtime.onMessage.addListener(function (msg, sender, sendResponse) {
console.log("message received", msg)
});
Content script works as expected on all code that's not depended on background.js
Folder structure
manifest.json (had to downgrade to v2 because Firefox doesn't support v3 yet)
{
"name": "Dev Mode",
"description": "Dev Mode",
"version": "0.0.1",
"manifest_version": 2,
"icons": {
"16": "./imgs/icon-16-dark.png",
"48": "./imgs/icon-48.png",
"128": "./imgs/icon-128.png"
},
"permissions": [
"activeTab",
"contextMenus",
"bookmarks",
"scripting",
"storage",
"<all_urls>"
],
"background": {
"scripts": ["background.js"],
"persistent": false // <-- also tried without, same result - background script doesn't lod
},
"browser_action": {
"default_icon": "./imgs/icon-16-dark.png",
"default_title": "Default Title"
},
"commands": {
"save-page": {
"suggested_key": {
"default": "Ctrl+Shift+S",
"mac": "Command+Shift+S"
},
"description": "some description"
}
},
"content_security_policy": "script-src 'self'; object-src 'self'; sandbox allow-scripts; script-src 'self' https://apis.google.com https://www.gstatic.com https://www.googleapis.com https://securetoken.googleapis.com; object-src 'self'",
"web_accessible_resources": [ "imgs/*.png", "overlay.html"],
"content_scripts": [
{
"matches": [
"<all_urls>"
],
"js": [
"/js/content.js"
],
"run_at": "document_end",
"all_frames": false
}
]
}
I'm testing the Firefox extension with web-ext run to test the extension locally.
The correct API for this in Manifest v2 is browserAction instead of action that is only available in MV3.
So to fix it, in your background.js, switch to
browser.browserAction.onClicked.addListener
browser.action in Firefox is available in MV3. Your extension uses MV2 i.e. "manifest_version": 2,
Note: This API is available in Manifest V3 or higher.
Note: MV3 support is very limited in Firefox at the moment.

Chrome webstore asking for Host permission justification despite not having it

After realizing about the delay that comes with having a hosting permission verified, I decided to it take out. My new manifest.json is:
{
"manifest_version": 2,
"name": "Daily",
"description": "Manage your calendars smarter!",
"content_security_policy": "script-src 'self' https://ajax.googleapis.com; object-src 'self'",
"version": "0.1.0",
"icons":{
"16": "logo-16.png",
"48": "logo-48.png",
"128": "logo-128.png"
},
"browser_action": {
"default_popup": "popup.html"
},
"web_accessible_resources": [
"scripts/audio_file.wav", "reminder.html"
],
"permissions": [
"storage",
"identity.email",
"tabs",
"https://www.example.com/yzs",
"https://www.example.com/xyz"
],
"background": {
"scripts": ["jquery-3.5.1.min.js", "background.js", "flipclock-min.js", "script.js"],
"persistent": false
}
}
Yet in the developer console I am required to justify why I am using hosting permission. I tried even starting a new process hoping it wouldn't ask anymore but nothing changed. Why is this?

How to port Chrome extension to Firefox addon?

I get this error in Firefox:
There was an error during the temporary add-on installation.
Error details ▼
File red_apples.zip does not contain a valid manifest
This is the extension I'm trying to port. Here's the manifest:
{
"manifest_version": 2,
"name": "Red Apples",
"permissions": [
"tabs", "activeTab"
],
"background": {
"persistent": false,
"scripts": [
"background.js"
]
},
"version": "0.0.0.2",
"icons": {
"16": "icon16.png",
"48": "icon48.png",
"128": "icon128.png"
},
"browser_action": {
"default_icon": "icon16.png",
"default_title": "Red Apples",
"default_popup": "popup.html"
},
"content_scripts": [
{
"matches": [
"<all_urls>"
],
"js": [
"script.js"
]
}
]
}
At the bottom of this tutorial it says there's a 99% chance it works without modification, if it passes the test here. But it passes the test and still doesn't work.
I get the manifest error both for the version packed with Chrome, and for the version just compressed as .zip.

Why does my manifest.json trigger a lengthly review due to Broad Host Permissions?

The chrome webstore flags my extension as having "Broad Host Permissions", but I cannot figure out what in my manifest.json is causing this result.
{
"name": "AudioEye Smart Remediation Builder",
"description": "Solve any issue of accessibility without writing code. Select elements, apply changes, and fix the web.",
"devtools_page": "src/main.html",
"version": "1.31.0",
"content_security_policy": "script-src 'self' https://myother.website.com/scripts/loader.js https://myotherother.website.com/somescript.js; object-src 'self'",
"author": "AudioEye",
"background": {
"scripts": [
"src/background.bundle.js"
]
},
"browser_action": {
"default_icon": {
"16": "icons/ae16.png",
"48": "icons/ae48.png",
"128": "icons/ae128.png"
},
"default_popup": "src/popup.html"
},
"content_scripts": [
{
"matches": [
"*://my.website.com/*"
],
"run_at": "document_end",
"all_frames": true,
"js": [
"src/installDefinition.js"
]
}
],
"externally_connectable": {
"matches": [
"*://my.website.com/*"
]
},
"icons": {
"16": "icons/ae16.png",
"48": "icons/ae48.png",
"128": "icons/ae128.png"
},
"manifest_version": 2,
"optional_permissions": [
"http://*/*",
"https://*/*",
"tabs"
],
"permissions": [
"cookies",
"webNavigation",
"activeTab",
"storage",
"contextMenus"
],
"web_accessible_resources": [
"src/inspected-window.bundle.js",
"src/smart-remediation-metadata.js"
]
}
I only use a broad match in the optional_permissions object, which gives the user explicit ability to allow/deny the permissions on each page they visit.
Why does my extension require a two week review due to broad host permissions?

Chrome.windows.create not working

In my content script I do
chrome.windows.create({url: "local.html", type: "popup"});
however, no window ever shows up.
Do I need to change my manifest file first? Why doesn't this function create a new window ever?
I have tabs enabled like so
{
"name": "Tool",
"version": "0.0.1",
"manifest_version": 2,
"description": "",
"homepage_url": "",
"icons": {
"16": "icons/on.png",
"48": "icons/on.png",
"128": "icons/on.png"
},
"default_locale": "en",
"background": {
"page": "src/bg/background.html",
"persistent": true
},
"browser_action": {
"default_icon": "icons/on.png",
"default_title": "browser action demo"
},
"permissions": [
"<all_urls>","tabs", "webNavigation"
],
"content_scripts": [
{
"run_at": "document_end",
"matches": [
"<all_urls>"
],
"js": [
"src/lib/jquery.min.js", "src/inject/inject.js"
],
"css": [
"src/inject/inject.css"
]
}
]
}
You are trying to call this from the content script.
Quoting the docs:
However, content scripts have some limitations. They cannot:
Use chrome.* APIs (except for parts of chrome.extension)
If you need to initiate some action that uses Chrome API from the content script, you have to message your background script to do this. See Architecture overview and Messaging.

Resources