Don't break when CSP is on in Firefox (#616)

[chearon]

Turns out #616 is specific to Firefox. In Firefox you can to use window.eval to evaluate on the content window. This tests the browser to see if the script should be evaluated that way, and uses the old behavior for Chrome/Safari.

[chearon]

Any chance someone could look at this for us lowly Firefox users? Here is the section in MDN that tells you about evaluating scripts in the content window if it helps.

(Also, not sure if I did the browser detection right, not something I try to do normally but maybe unavoidable in an extension).

[michalsnik]

Hey @chearon Thanks for taking the time and working on it, however I don't think this is the right solution. What I see here is omitting unsafe-inline CSP directive, but there is also unsafe-eval which usually is used alongside unsafe-inline. Both are strongly against all CSP reasoning.

I personally don't set those headers in dev environment, but rather on staging/production, where they actually matter.

Have you considered this approach, or am I missing something? :)

[chearon]

What I see here is omitting unsafe-inline CSP directive, but there is also unsafe-eval which usually is used alongside unsafe-inline

This still works with unsafe-eval on. This PR basically makes the extension follow Mozilla's advice 🙂

I personally don't set those headers in dev environment, but rather on staging/production, where they actually matter.

That's what I did initially, but we realized that that's a dangerous route to go down because you won't catch CSP issues until after deployment.

[michalsnik]

Ah, so what you're saying is that Firefox treats eval executed by it's extensions as something that doesn't violate unsafe-eval option, and it's only problem is with inline scripts injected by extensions? If yes, then your solution might well be the answer in the end :) I have to investigate it just to be sure that's the case.

[chearon]

only problem is with inline scripts injected by extensions?

Yep! I guess Chrome keeps track of where a <script> was created and uses that to determine CSP violation, whereas Firefox prefers you to use window.eval(). (Side note: the article implies that window.eval() is different than eval() in extensions 😐)

[michalsnik]

Such a lovely quirk :D I'll try to run this solution natively on my mac tomorrow and I'll also confirm firefox detection then :) Hopefully I'll have some time in the evening.

[chearon]

Any update on this? Looks like there are a few other Firefox users after all!

[vburzynski]

Any update on this?

[manniL]

Would love to see this merged! 👍

[manniL]

❤️