-
-
Notifications
You must be signed in to change notification settings - Fork 6.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Mermaid versions after v9.2.2 cannot be injected into Firefox addons #5378
Comments
As it turns out the problem can be resolved by replacing all occurrences of |
Can you check if https://cdnjs.cloudflare.com/ajax/libs/mermaid/11.0.0-alpha.6/mermaid.min.js works? |
No it doesn't work, still the same issue in 11.0.0-alpha.6 |
As far as I understand the One guy showed me a WebPack plugin that he built to do just that - replace I don't know how and if changing this is going to affect backward compatibility for example. |
Rollup was updated to v3 in 9.3.0, we also switched to using an esm version of lodash as well. |
@remcohaszing @aloisklink @nirname @Yokozuna59 @Yash-Singh1 does anyone of you folks have any insights? |
No, in fact I'm not building Mermaid myself, but following what this guy did I am simply going to replace all occurrences of That works, however I am going to have some issues with the review process of my extension afterwards because I am modifying the official build, and that is being compared by the reviewer. So hopefully that's going to pass the validation, but of course it would be best if we have that fixed in the official build if there is no other downside related to it. |
This seems to be coming from the https://github.com/lodash/lodash/blob/51ed7e7707047aae23433bebaf461064787b006a/_root.js#L7 I think it would make sense to patch https://mathiasbynens.be/notes/globalthis#robust-polyfill ...or we could just replace it with |
@sidharthv96, no these are two separate issues. Firefox cannot inject any version of Mermaid after v9.3.0 (this issue), any Chromium based browser (the rest of them) cannot inject Mermaid after v10.9.0 (#5383). What I will do for the upcoming release of my extension is:
This will make it work in all browsers for the time being, but of course if the official build does not get fixed I will have to think about something else next time I have to do a release. |
Description
I have a browser extension that injects
mermaid.min.js
as a content script:In Chromium based browsers the above code injects the latest
mermaid.min.js
build without any issues. However, in Firefox after v9.2.2 it is no longer possible to inject themermaid.min.js
build using the exact same code.Initially I was thinking that it is a temporary issue, so that's why I did not report it immediately, but at this point I have users asking me why am I not updating the Mermaid version in the Firefox version of the extension (same code base as the Chromium one), and I cannot figure out what changed after v9.2.2 that might be causing this.
According to the release docs for v9.3.0 https://github.com/mermaid-js/mermaid/releases/tag/v9.3.0 the build become:
So I'm wondering if it is something related to that.
Note that this is happening ever since Dec 15th 2022 when v9.3.0 got released, so through out all this time all versions of Firefox consistently fail to inject the library after v9.3.0, but they can inject v9.2.2 just fine. I have tested every Mermaid build ever since.
Steps to reproduce
A simple Firefox addon can be created to reproduce this issue:
manifest.json
background.js
content.js
mermaid.min.js
Navigate to
![Screenshot from 2024-03-12 11-35-01](https://private-user-images.githubusercontent.com/1694112/312029712-8b1d6ba8-f14a-4b91-b5a1-bf20fc55236c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3Mjg3NzIsIm5iZiI6MTcyNDcyODQ3MiwicGF0aCI6Ii8xNjk0MTEyLzMxMjAyOTcxMi04YjFkNmJhOC1mMTRhLTRiOTEtYjVhMS1iZjIwZmM1NTIzNmMucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyNyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjdUMDMxNDMyWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9M2E5MGMyOWUxMjI5NzZhODU2MGE3OTYyYmNhYjE1YmM4NGUxZWRlOGZlYTkzNmJiZTdlMTZiODcyMzdiM2JjYSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ._pqzxqQituvfBsEB93TSDcWC6A9_Lu1kKv_f1vSCZYA)
about:debugging#/runtime/this-firefox
Click on the
Load Temporary Add-on...
buttonFind the folder containing the 3 files from above and double click on the
manifest.json
fileMake sure the
![Screenshot from 2024-03-12 11-54-41](https://private-user-images.githubusercontent.com/1694112/312029631-3faff224-6034-46b5-8dfc-1e0a5e992fc9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3Mjg3NzIsIm5iZiI6MTcyNDcyODQ3MiwicGF0aCI6Ii8xNjk0MTEyLzMxMjAyOTYzMS0zZmFmZjIyNC02MDM0LTQ2YjUtOGRmYy0xZTBhNWU5OTJmYzkucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyNyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjdUMDMxNDMyWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9YTMwZGZmZWZlOTA1YTc1MzQ1OTEyMmRhMDExMzRhNjNkZmM3Mzk1NmUzNGFlMzFiNzRlYTA5MGU2OTc4MmExZCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.PQY3K9axQwThBoJsx4aGWi-N-McOd-56Rb29MgR3GEQ)
Access the data for all websites
switch is turned on for your temporary extension inabout:addons
Navigate to any webpage
When using Mermaid v9.2.2 https://cdnjs.cloudflare.com/ajax/libs/mermaid/9.2.2/mermaid.min.js as the source of
![Screenshot from 2024-03-12 11-34-13](https://private-user-images.githubusercontent.com/1694112/312031151-86a5117d-dd5f-47ed-922e-f7f6ae5f580e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3Mjg3NzIsIm5iZiI6MTcyNDcyODQ3MiwicGF0aCI6Ii8xNjk0MTEyLzMxMjAzMTE1MS04NmE1MTE3ZC1kZDVmLTQ3ZWQtOTIyZS1mN2Y2YWU1ZjU4MGUucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyNyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjdUMDMxNDMyWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9MGNkOTVkM2YwZjA4MzIzMDg2OTM5YzQwMWJkYmMwN2M2ZDlmNTY0ZjI2MTQxMDVjY2U3ODJlNzg1MDcyYzI1MCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.SwpLYuYa6hznLaDlEESnIgnFerLOJxo4Nj3vSTjh2V4)
mearmaid.min.js
the injecting works and therefore you will see the following output in the console log of the page you are looking at:Meaning both the
mermaid.min.js
and thecontent.js
got injected and you can see themermaid
object being printed out in the console.Now,
mermaid.min.js
with the contents of https://cdnjs.cloudflare.com/ajax/libs/mermaid/9.3.0/mermaid.min.jsabout:debugging#/runtime/this-firefox
and click on theReload
button for your temporary addonInspect
button to view the console log for the background pageNow in the console log for the background page of the extension you can see the following:
![Screenshot from 2024-03-12 11-32-41](https://private-user-images.githubusercontent.com/1694112/312032557-999fcf3a-1f4d-42f2-946d-932f3eefd131.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ3Mjg3NzIsIm5iZiI6MTcyNDcyODQ3MiwicGF0aCI6Ii8xNjk0MTEyLzMxMjAzMjU1Ny05OTlmY2YzYS0xZjRkLTQyZjItOTQ2ZC05MzJmM2VlZmQxMzEucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyNyUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjdUMDMxNDMyWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9YmQ3YTIyZTY2NWYzMjY0Zjc5OTRiODA4N2ZlYzM0MmViMjM2OGZkZWY4ZmRmOGM5NmI2Y2ZjNzY3YWIzNDFjZiZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.Kksk3ZKyWc4NyKIMDSe_y5cJi9BMDTIjrrxVWdLr8pk)
So apparently on line
23
inmermaid.min.js
nowa call to Function() is being blocked by the CSP
and therefore the inject fails as a whole. The inject is failing from v9.3.0 onward because of a Content Security Policy set for browser addons in Firefox. Note that the whole purpose of injectingmermaid.min.js
instead of adding it as ascript
tag into the page is to circumvent another set of CSP issues, but in the content page context afterwards, so there is really no other way for me to use Mermaid other than injecting it in the background page.I have examined the offending line 23 in both v9.2.2 and v9.3.0, but I cannot spot any significant difference between the two.
Screenshots
No response
Code Sample
No response
Setup
Suggested Solutions
No response
Additional Context
No response
The text was updated successfully, but these errors were encountered: