Closed hugomano closed 5 years ago
chrome-extension://
frame-src
CSP
[ ] before this PR: log in Gmail with a @gmail.com account, onboarding iframe is not displayed.
@gmail.com
[ ] after this PR: log in Gmail with a @gmail.com account, onboarding iframe is displayed
Protocol Handler In the Gmail dev tool with the Mixmax contex console:
[ ] ~fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/manifest.json', { mode: 'no-cors' }).then(console.log) response is net::FAILED~
fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/manifest.json', { mode: 'no-cors' }).then(console.log)
net::FAILED
[ ] ~fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.html', { mode: 'no-cors' }).then(console.log) response is HTTP 200~
fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.html', { mode: 'no-cors' }).then(console.log)
HTTP 200
[ ] ~fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.js', { mode: 'no-cors' }).then(console.log) response is HTTP 200~
fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.js', { mode: 'no-cors' }).then(console.log)
:+1: As discussed, this should be only on the resources listed as web_accessible_resources
web_accessible_resources
https://github.com/electron/electron/issues/12909#issuecomment-389225310
What is this PR
chrome-extension://
is not bypassed in CSP check at the iframe document level, so we add it to theframe-src
to the directive in the Content Security Policy header More hereHow to test
CSP
[ ] before this PR: log in Gmail with a
@gmail.com
account, onboarding iframe is not displayed.[ ] after this PR: log in Gmail with a
@gmail.com
account, onboarding iframe is displayedProtocol Handler In the Gmail dev tool with the Mixmax contex console:
[ ] ~
fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/manifest.json', { mode: 'no-cors' }).then(console.log)
response isnet::FAILED
~[ ] ~
fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.html', { mode: 'no-cors' }).then(console.log)
response isHTTP 200
~[ ] ~
fetch('chrome-extension://ocpljaamllnldhepankaeljmeeeghnid/src/iframeProxy/proxy.js', { mode: 'no-cors' }).then(console.log)
response isHTTP 200
~