CODEWITHSUNDEEP
javascriptjqueryjquery-uifirefoxfirefox-addon
Dutts
Dutts

Reputation: 6191

How to use a contentScriptFile from an external URI in a Firefox addon

My latest update to a Firefox addon has been rejected because I've used a custom jquery-ui (generated by their site with just the widgets I wanted) and it fails their checksum check.

Your add-on includes a JavaScript library file that doesn't match our checksums for known release versions. We require all add-ons to use unmodified release versions, obtained directly from the developer's website. We accept JQuery/JQuery-UI libraries downloaded from 'ajax.googleapis.com', 'jquery.com' or 'jqueryui.com'; and used without any modification. (file-name change does not matter) I'm sorry, but we cannot accept modified, re-configured or customized libraries.

Fair enough, I could just download the full one and resubmit, but I was wondering if it is possible to link to one instead?

If I try this:

contentScriptFile: [self.data.url("https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js"), self.data.url("https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.3/jquery-ui.min.js"), self.data.url("api.js")],

I get an error at runtime telling me that content scripts much be local. Both google and the API seem to be proving illusive to me for an answer.

Does anyone know if this is possible and how?

Cheers

Rich

Upvotes: 1

Views: 152

Answers (1)

the8472
the8472

Reputation: 43052

self.data.url("https://...")

It seems like you haven't read the documentation on data.url()

It clearly states that

The data.url() method returns a resource:// url that points at an embedded data file.

Which means you cannot link to an external resource.

Does anyone know if this is possible and how?

No, contentScriptFile runs with (slightly) elevated privileges compared to regular web content, that's why you are not allowed to load scripts from sources that might change and could theoretically inject malicious code in the future.

If you want to rely on external libraries and keep them up to date you could simply write a little build script that always downloads the newest version when building a new XPI.

In principle you could just load the script via privileged XHR and then pass it as string, but that's probably not gonna pass AMO review.

And piece of personal opinion: Since you're targeting a specific browser you don't really need jquery for its cross-browser logic, modern web APIs provide lots of convenience methods that you can get pretty far just with vanilla ES6-javascript and state-of-the-art DOM APIs. Iterators and arrow functions also make bulk operations fairly concise.

Upvotes: 4

Related Questions