Web extension conten script insert css and CSP

Add-ons Development
#1

https://crates.io CSP style-src = ‘https://crates.io https://www.google.com https://ajax.googleapis.com’

Execution code in content script:

var style1 = document.createElement('style');
style1.innerHTML = 'body {font-size: 2em;}';
document.head.append(style1)

The style1 element can be parsed normally

Execution code in content script:

var style = document.createElement('style');
style.appendChild(document.createTextNode('* { color: red; }'));
document.head.appendChild(style);

this style element blocked by CSP;

why?

thanks.

Demo Extension: http://xianqiao.wang/test/csp-css-test-1.0.zip

#2

Ignoring the page CSP for content inserted by extensions is something that’s currently being worked on: https://bugzilla.mozilla.org/show_bug.cgi?id=1267027

1 Like