search

stoically / radical

Element (Riot Web) unofficially bundled as Firefox Add-on
https://addons.mozilla.org/firefox/addon/radical-web
MIT License
32 stars 1 forks source link

Running as content script #12

Closed stoically closed 4 years ago

stoically commented 4 years ago

If running Riot Web somehow as content script would be possible it could increase security by a great deal. Might be hard to do because of Xray vision.

stoically commented 4 years ago

Implemented and released as v1.5.7.9 - tho, not possible in Chrome due to API limitations. Also dropped the requirement for unsafe-eval in Firefox.

stoically commented 4 years ago

Currently content scripts in Firefox are not subject to the extension page CSP, so it's actually not really safer, hence running as content script was reverted. This will change in the future in Firefox, as described in the links mentioned in #16, which might lead to reconsideration of this approach. As simple security measure the script that runs riot web now removes all APIs which aren't needed:

https://github.com/stoically/riot-webext/blob/1afc3725c66deb1108621ced5ef6e5a3d4600ae2/src/riot.ts#L11-L19