0

How can i perform loading chrome extension background script from remote? Is it passible? With eval or something? how to do this, if am hosting the script on remote digital ocean?

luci
  • 31
  • 1
  • 5
  • can i load javascirpt in background script and execute it? i mean i can load code and use the thing like `chrome.runtime.onMessage` inside that eval/ loaded script? will it work ? does linked `duplicate` describes this? – luci Nov 16 '18 at 14:54
  • I'm removing the duplicate, since the linked question https://stackoverflow.com/questions/7781851/loading-external-javascript-in-google-chrome-extension talks specifically about content scripts, and this is specifically about background scripts. – Xan Nov 16 '18 at 15:23
  • It's possible by modifying [content_security_policy](https://developer.chrome.com/extensions/content_security_policy) but that's bad practice which will be deprecated in the future [ManifestV3](https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/) extensions and it'll make your extension suspicious in the eyes of WebStore reviewers. – wOxxOm Nov 16 '18 at 15:31

1 Answers1

0

DISCLAIMER: Loading background scripts from a remote site is generally NOT recommended, as it gives the remote script a lot of control of the user's browser if not their whole machine.

But if you insist, you could do something like this.

manifest.json

{
  ...
  "background": { "scripts": ["background.js"] },
  "permissions": [ "http://www.yourwebiste.com/*" ],
  ...
}

background.js

var xhr = new XMLHttpRequest();
xhr.open("GET", "http://www.yourwebiste.com/remotescript.js", false);
xhr.send();
let code = xhr.responseText;
eval(code);

Regardless... DON'T DO THIS! In the name of security, just don't. Unless you are experienced and understand the caveats, I would whole hardheartedly recommend you don't use this method as it might introduce the execution of foreign code that you might not have control over, i.e. the remote script.

EyuelDK
  • 3,029
  • 2
  • 19
  • 27
  • Won't this get your extension flagged and removed by Google? We have a private extension that we only distrubute to employees, and the current deployment process in the chrome store is frankly shit. Even if we were to update it to allow a remote update URL where we could deploy the package to, half the time the damned thing doesn't even auto update, meaning my people have to uninstall and reinstall every time we update. When auto update does work, it still takes 1-2 hours for the version to propagate. I wish the support for extensions were better supported. Thanks google! – Askdesigners Jan 27 '20 at 08:32