Inconsistency: CSP sandbox directive and content script and style injection into pages #285
Description
Chrome injects content scripts and styles into contexts with CSP directive sandbox, while Firefox and Safari do not.
Philosophically, since typically extension resources are exempt from other CSP directives like script-src, style-src, and other, browsers should exempt extension resources from sandbox as well. However, two browsers have this "bug" and only one is "correct", which is not typical.
Testing details
Real-world URL
This issue was initially discovered on the following URL:
https://ci.ubports.com/job/docs.ubports.com/job/PR-508/7/artifact/_build/html/..index.html
This originally came up at: darkreader/darkreader#9861
Minimal demo
Chrome
When a tab is opened, it shows only red Script ran text. Text comes from script, while red color comes from injected style.
Safari and Firefox
Extension has no effect on the tab.
Code
NodeJS Express server:
'use strict';
const express = require('express');
const app = express();
app.get('/index.html', (req, res) => {
res.set('content-security-policy', 'sandbox');
res.send('Hello world!');
});
app.listen(8000);Extension manifest.json:
{
"manifest_version": 2,
"name": "Demo",
"description": "Demo",
"version": "1.0",
"content_scripts": [
{
"matches": ["*://*/*"],
"js": ["script.js"],
"css": ["style.css"]
}
]
}Extension content script script.js:
document.body.innerText = 'Script ran';Extension injected style style.css:
body {
color: red;
}