CODEWITHSUNDEEP
javascriptgoogle-chromegoogle-chrome-extensioncontent-security-policy
Jan Grz
Jan Grz

Reputation: 1473

How to remove unsafe-eval from chrome extension's content_security_policy

I have removed all usages of eval and and new Function from a legacy chrome extension, that I am mantaining. How should I update the content_security_policy section in my manifest.json?

Currently it looks like this:

{
  "content_security_policy": "script-src 'self' 'unsafe-eval' https://app.xyz.com; object-src 'self'"
}

If I understand the CSP in chrome extension correctly, after I removed all eval and new Function calls from the extension code I may remove the unsafe-eval from the manifest.json

Upvotes: 3

Views: 2637

Answers (1)

Noam Hacker
Noam Hacker

Reputation: 4825

Eval and related functions are disabled. [But,] the policy against eval() and its relative new Function(String) can be relaxed by adding 'unsafe-eval' to your policy

This means that code using eval and new Function will only work if you have

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

in your manifest.

Try taking this line out of your manifest and running your extension. If everything still works as expected, then you are safe to remove this policy from your manifest, as you have removed all disabled functions correctly.

Link to CSP

Note: you must remove all the necessary functions related to eval (as described here).

Code like the following does not work:

window.setTimeout("alert('hi')", 10);
window.setInterval("alert('hi')", 10);

Upvotes: 2

Related Questions