2 years ago
#60742
elunomas
Can chrome extension content scripts load images regardless of host's Content Security Policy?
I have created a Chrome extension with MV3. One of my content scripts pops up an image (a web_accessible_resource) when a user is on two specific sites. The img loads fine on site #1, but not on site #2. If I inspect site #2 in devtools and manually change my img src (to "chrome-extension://file1.png"), the html source code for the img src immediately changes to "unknown". If I repeat this edit and make the img-src to be an image off of the same domain as site #2, the src changes successfully (it does not become "unknown"), which makes me think it must be a CSP-related issue. But there are no errors that I can see, so I cannot confirm this conclusion. Here's my manifest.json:
"web_accessible_resources": [
{
"resources": [ "images/myimage.png"],
"matches": [ "http://*/*","https://*/*" ]
}
],
And the code I use in my content script to create the image and assign the src:
let iconImage = new Image();
iconImage.className="myImageClass";
iconImage.src=chrome.runtime.getURL("/images/myimage.png");
This successfully loads the image when my content script runs on Site #1, but not on Site #2. I have also tried loading the image from an external public host, which works fine on Site #1, but not Site #2 (again indicating to me that CSP is the root cause).
Everything I've read about extension resources seems to suggest that web_accessible_resources are exempt from CSP rules, but then what am I missing?
google-chrome
content-security-policy
chrome-extension-manifest-v3
0 Answers
Your Answer