Make firefox problems go away #928
Conversation
Just load the sandbox from a blob url, then the extension CSP doesn't apply to it.
Load the abs.twimg.com in the sandbox which does not run into the firefox builtin blocker, i'm guessing because its js world is considered part of the twitter.com page and thus allowed to bypass the twitter.com blocker or some shit idk
|
I don't understand what this PR does. Looks like just restructured code to me. Extension was taken down for using eval, you can't really fix that. |
|
First commit removes the content_security_policy from the manifest. Now the challenge code is evaluated in the context of twitter.com and not the extension. That was the issue, right? Second commit resolves the bug where enhanced tracking protection made the fetch for the challenge fail, which I didn't know about for a long time because that was just timing out and then using unsigned requests, until I git pulled the repo to work on this and got the |
|
Like, the sandbox.html was a very ineffective sandbox - it had full access to extension APIs with the permission of the extension, and twitter could have pushed code which would remotely execute with the permission of the extension. No longer possible when loading the sandbox from the origin of a twitter blob url, it would now just run with the permission of twitter.com as was designed. Now that I'm explaining it here it seems clear that this is worth fixing for chrome too. |
|
Hm, I didn't know you can use object urls for iframes. I don't know if it'll pass AMO's review, but it's a worth a try, thanks! |
|
Also, Chrome version is using built-in sandbox feature in manifest, so it can't access any APIs |
|
Oh didn't know that. I guess the issue is firefox doesn't support the sandbox mode |
Fixed two, including the one that (afaik) got the addon taken down from AMO.