{"action":"created","issue":{"url":"https://api.github.com/repos/firemacs/Firemacs/issues/1","repository_url":"https://api.github.com/repos/firemacs/Firemacs","labels_url":"https://api.github.com/repos/firemacs/Firemacs/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/firemacs/Firemacs/issues/1/comments","events_url":"https://api.github.com/repos/firemacs/Firemacs/issues/1/events","html_url":"https://github.com/firemacs/Firemacs/issues/1","id":227733116,"number":1,"title":"Firefox applies CSP to extension content scripts","user":{"login":"aaron-em","id":5650970,"avatar_url":"https://avatars1.githubusercontent.com/u/5650970?v=3","gravatar_id":"","url":"https://api.github.com/users/aaron-em","html_url":"https://github.com/aaron-em","followers_url":"https://api.github.com/users/aaron-em/followers","following_url":"https://api.github.com/users/aaron-em/following{/other_user}","gists_url":"https://api.github.com/users/aaron-em/gists{/gist_id}","starred_url":"https://api.github.com/users/aaron-em/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaron-em/subscriptions","organizations_url":"https://api.github.com/users/aaron-em/orgs","repos_url":"https://api.github.com/users/aaron-em/repos","events_url":"https://api.github.com/users/aaron-em/events{/privacy}","received_events_url":"https://api.github.com/users/aaron-em/received_events","type":"User","site_admin":false},"labels":[{"id":602287155,"url":"https://api.github.com/repos/firemacs/Firemacs/labels/proof%20of%20concept","name":"proof of concept","color":"bfdadc","default":false}],"state":"open","locked":false,"assignee":{"login":"aaron-em","id":5650970,"avatar_url":"https://avatars1.githubusercontent.com/u/5650970?v=3","gravatar_id":"","url":"https://api.github.com/users/aaron-em","html_url":"https://github.com/aaron-em","followers_url":"https://api.github.com/users/aaron-em/followers","following_url":"https://api.github.com/users/aaron-em/following{/other_user}","gists_url":"https://api.github.com/users/aaron-em/gists{/gist_id}","starred_url":"https://api.github.com/users/aaron-em/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaron-em/subscriptions","organizations_url":"https://api.github.com/users/aaron-em/orgs","repos_url":"https://api.github.com/users/aaron-em/repos","events_url":"https://api.github.com/users/aaron-em/events{/privacy}","received_events_url":"https://api.github.com/users/aaron-em/received_events","type":"User","site_admin":false},"assignees":[{"login":"aaron-em","id":5650970,"avatar_url":"https://avatars1.githubusercontent.com/u/5650970?v=3","gravatar_id":"","url":"https://api.github.com/users/aaron-em","html_url":"https://github.com/aaron-em","followers_url":"https://api.github.com/users/aaron-em/followers","following_url":"https://api.github.com/users/aaron-em/following{/other_user}","gists_url":"https://api.github.com/users/aaron-em/gists{/gist_id}","starred_url":"https://api.github.com/users/aaron-em/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaron-em/subscriptions","organizations_url":"https://api.github.com/users/aaron-em/orgs","repos_url":"https://api.github.com/users/aaron-em/repos","events_url":"https://api.github.com/users/aaron-em/events{/privacy}","received_events_url":"https://api.github.com/users/aaron-em/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2017-05-10T16:10:20Z","updated_at":"2017-05-10T18:42:39Z","closed_at":null,"body":"While investigating an issue in my PoC with the help of #webextensions@irc.mozilla.org, I stumbled upon [Firefox bug 1267027](https://bugzilla.mozilla.org/show_bug.cgi?id=1267027), \"Page CSP should not apply to content inserted by content scripts.\"\r\n\r\nMy original proof of concept revolved around injecting a content script which would capture keystrokes and dispatch to a background script with the necessary browser API access to invoke actions. Since extension content scripts can't currently be injected into pages unless their CSP permits it, this method cannot work reliably.\r\n\r\nPotential workarounds include:\r\n- Capture keystrokes directly in the background script, if that's possible\r\n- Find a reliable workaround for the bug, without requiring unsafe configuration changes such as disabling CSP enforcement entirely\r\n\r\nI'll be trying each of those out in turn, and will update this issue to document the results. If neither can be made workable, I can proceed in development with an alternate Firefox profile which has CSP disabled, but we'd have to wait to release until a fix lands in Firefox for the CSP bug.\r\n\r\nFurther bulletins as events warrant."},"comment":{"url":"https://api.github.com/repos/firemacs/Firemacs/issues/comments/300576275","html_url":"https://github.com/firemacs/Firemacs/issues/1#issuecomment-300576275","issue_url":"https://api.github.com/repos/firemacs/Firemacs/issues/1","id":300576275,"user":{"login":"brudgers","id":4572372,"avatar_url":"https://avatars3.githubusercontent.com/u/4572372?v=3","gravatar_id":"","url":"https://api.github.com/users/brudgers","html_url":"https://github.com/brudgers","followers_url":"https://api.github.com/users/brudgers/followers","following_url":"https://api.github.com/users/brudgers/following{/other_user}","gists_url":"https://api.github.com/users/brudgers/gists{/gist_id}","starred_url":"https://api.github.com/users/brudgers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brudgers/subscriptions","organizations_url":"https://api.github.com/users/brudgers/orgs","repos_url":"https://api.github.com/users/brudgers/repos","events_url":"https://api.github.com/users/brudgers/events{/privacy}","received_events_url":"https://api.github.com/users/brudgers/received_events","type":"User","site_admin":false},"created_at":"2017-05-10T18:42:39Z","updated_at":"2017-05-10T18:42:39Z","body":"A couple of other bits:\n\nI added a wiki-page yesterday. My plan is to solicit advice from the\nMozilla community, probably using the Discourse page. In particular if\nthere are tools to detect areas of concern and also regarding\nadministrative procedures for approval of the new extension version and if\ntheir will be any problems around naming. I just have not written it up yet.\n\nAlso, for what it might be worth, I've been using the key-listener I\ndescribed [here](\nhttps://codereview.stackexchange.com/questions/139316/client-side-javascript-aka-greasemonkey-key-event-handler)\nin\nFirefox for scripting using GreaseMonkey. Nobody could come up with\nimprovements. It might or might not be useful.\n\nI plan to start working through the Mozilla webextensions tutorial as soon\nas I clear a couple of other things off my plate.\n\nCheers.\n\n\n\nOn Wed, May 10, 2017 at 1:15 PM, ben rudgers <ben.rudgers@gmail.com> wrote:\n\n> Thanks Aaron,\n>\n> Reading through the linked bug, it looks like a corner case relating to\n> implementing CSP when a content script is injected with `script-src\n> 'none'`. Maybe as if `'none'` is not whitelisted by the CSP.\n>\n> If that's about correct, then maybe setting `script-src` to point to a\n> file local to the extensions might work...though I don't really know,\n> pointing to a file that is local to the extension smells like the happy\n> path. But I am just speculating.\n>\n> Ben\n>\n> On Wed, May 10, 2017 at 11:10 AM, Aaron Miller <notifications@github.com>\n> wrote:\n>\n>> While investigating an issue in my PoC with the help of #\n>> webextensions@irc.mozilla.org, I stumbled upon Firefox bug 1267027\n>> <https://bugzilla.mozilla.org/show_bug.cgi?id=1267027>, \"Page CSP should\n>> not apply to content inserted by content scripts.\"\n>>\n>> My original proof of concept revolved around injecting a content script\n>> which would capture keystrokes and dispatch to a background script with the\n>> necessary browser API access to invoke actions. Since extension content\n>> scripts can't currently be injected into pages unless their CSP permits it,\n>> this method cannot work reliably.\n>>\n>> Potential workarounds include:\n>>\n>>    - Capture keystrokes directly in the background script, if that's\n>>    possible\n>>    - Find a reliable workaround for the bug, without requiring unsafe\n>>    configuration changes such as disabling CSP enforcement entirely\n>>\n>> I'll be trying each of those out in turn, and will update this issue to\n>> document the results. If neither can be made workable, I can proceed in\n>> development with an alternate Firefox profile which has CSP disabled, but\n>> we'd have to wait to release until a fix lands in Firefox for the CSP bug.\n>>\n>> Further bulletins as events warrant.\n>>\n>> —\n>> You are receiving this because you are subscribed to this thread.\n>> Reply to this email directly, view it on GitHub\n>> <https://github.com/firemacs/Firemacs/issues/1>, or mute the thread\n>> <https://github.com/notifications/unsubscribe-auth/AEXE1ESE4eWsr7WhyF6E0eaKpodWgcIUks5r4eFsgaJpZM4NW5H3>\n>> .\n>>\n>\n>\n"}}
{"actor":{"display_login":"brudgers"}}