# Insert a Javascript locally into mainifest.json file \[ Webextensions \]

**URL:** <https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758>\
**Category:** Development\
**Created:** [February 19, 2017, 9:35pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758 "2017-02-19T21:35:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlackHawk](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/blackhawk/32/13565_2.png) [@BlackHawk](https://discourse.mozilla.org/u/BlackHawk)\
**Post date:** [February 19, 2017, 9:35pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/1 "2017-02-19T21:35:03Z")

</div>

Hi,

I have tried to insert a js file called “popup/do.js” into mainifest.json file in the “background” and “browser\_action” but it didn’t working with the “default\_popup”: “popup/index.html” .

How can I fix this problem , please ?

- Note : the “popup/do.js” file is userd into the popup menu of the add-no in the toolbar of the browser.

When I contact the support they said that :

> We don’t allow add-ons to use remote scripts because they can create serious security vulnerabilities. We also need to review all add-on code, and this makes it much more difficult. Please insert those scripts locally from your add-on code.  
> eg: do.js

Thanks

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [February 20, 2017, 5:20am UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/2 "2017-02-20T05:20:06Z")

</div>

Use [\<script\>](https://developer.mozilla.org/en/docs/Web/HTML/Element/script) tag in `popup/index.html`

Here is an example: [The popup](https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Your_second_WebExtension#The_popup)

---

<div class="post-metadata">

**Author:** ![BlackHawk](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/blackhawk/32/13565_2.png) [@BlackHawk](https://discourse.mozilla.org/u/BlackHawk)\
**Post date:** [February 20, 2017, 12:23pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/3 "2017-02-20T12:23:24Z")

</div>

I was using the element into the of popup html page then upload to AMO , then they reply that :

> We don’t allow add-ons to use remote scripts because they can create serious security vulnerabilities. We also need to review all add-on code, and this makes it much more difficult. Please insert those scripts locally from your add-on code.  
> eg: do.js

Should I require the js script using element into the last of the element ?

---

<div class="post-metadata">

**Author:** ![NilkasG](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@NilkasG](https://discourse.mozilla.org/u/NilkasG)\
**Post date:** [February 20, 2017, 12:32pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/4 "2017-02-20T12:32:10Z")

</div>

You have to put a copy of the script file in the folder that contains your `manifest.json` (or any folder therein).

If you want the script to run in your popup (`browser_action` or `page_action`), you need to add a `<script>` tag in its `.html` file pointing at the script file, e.g. `<script src="/popup/do.js"></script>`.

What you can **not** do is use scripts from remote servers, e.g. `<script src="https://some.cdn.com/popup/do.js"></script>`.

---

<div class="post-metadata">

**Author:** ![BlackHawk](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/blackhawk/32/13565_2.png) [@BlackHawk](https://discourse.mozilla.org/u/BlackHawk)\
**Post date:** [February 20, 2017, 12:54pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/5 "2017-02-20T12:54:15Z")

</div>

Thanks a lot for this answer,

Everything is clear now , but you mean I can insert this into the `<head>` element or I should insert it into the `<body>` element of the popup’s .html file ?

---

<div class="post-metadata">

**Author:** ![NilkasG](https://avatars.discourse-cdn.com/v4/letter/n/0ea827/32.png) [@NilkasG](https://discourse.mozilla.org/u/NilkasG)\
**Post date:** [February 20, 2017, 1:34pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/6 "2017-02-20T13:34:08Z")

</div>

That doesn’t really matter. The only non-cosmetic difference would be the load order, if you have multiple `<script>` tags, and how far the DOM is built when your script gets executed. If you don’t wait for `DOMContentLoaded`, your script will only be able to use elements defined above it.

---

<div class="post-metadata">

**Author:** ![BlackHawk](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/blackhawk/32/13565_2.png) [@BlackHawk](https://discourse.mozilla.org/u/BlackHawk)\
**Post date:** [February 20, 2017, 1:37pm UTC](https://discourse.mozilla.org/t/insert-a-javascript-locally-into-mainifest-json-file-webextensions/13758/7 "2017-02-20T13:37:53Z")

</div>

Thank you so much 😍