MV3 & Sandbox Support

[tweak support]

Hey team,

Are sandboxes part of the MV3 plan? Will we still be able to keep using them? Specifically concerned about the use case of running `eval()` for user-defined code - arbitrary strings of javascript. ref

Cheers!

[tweak support]

Bumping this question. Could someone take a look at it.

Thank you!

[wOxxOm]

Apparently yes, judging by the fact that a recent sandbox-related bug was fixed for MV3, https://crbug.com/1218196

[hrg...@gmail.com]

Even if sandboxed iframes are still supported in MV3, we won't have a background page to create those iframes.

We will have to open a separate tab/window for the only purpose of evaluating user code in the background foreground.

So the usefulness of sandboxes is reduced to contrived use cases only.  

[tweak support]

Yes, exactly.

Without the ability to access the DOM in background pages the documentation makes no sense. Is there an updated documentation for sandboxes for MV3?

Would really appreciate more feedback on this. Executing user code is one of our critical features in the roadmap.

Thank you

On Thursday, July 1, 2021 at 11:40:25 AM UTC+2 alsadik...@gmail.com wrote:

2021-07-01 5:24 غرينتش+03:00, hrg...@gmail.com <hrg...@gmail.com>:

> Even if sandboxed iframes are still supported in MV3, we won't have a
> background page to create those iframes.
> We will have to open a separate tab/window for the only purpose of
> evaluating user code in the background foreground.
> So the usefulness of sandboxes is reduced to contrived use cases only.
>
> On Wednesday, June 30, 2021 at 10:48:49 AM UTC-4 wOxxOm wrote:
>
>> Apparently yes, judging by the fact that a recent sandbox-related bug was
>>
>> fixed for MV3, https://crbug.com/1218196
>>
>> On Tuesday, June 29, 2021 at 9:31:10 PM UTC+3 help....@gmail.com wrote:
>>
>>> Bumping this question. Could someone take a look at it.
>>>
>>> Thank you!
>>>
>>> On Sunday, June 20, 2021 at 4:56:25 PM UTC+2 tweak support wrote:
>>>
>>>> Hey team,
>>>>
>>>> Are sandboxes

>>>> <https://developer.chrome.com/docs/extensions/mv3/manifest/sandbox/>

>>>> part of the MV3 plan? Will we still be able to keep using them?
>>>> Specifically concerned about the use case of running `eval()` for
>>>> user-defined code - arbitrary strings of javascript. ref

>>>> <https://developer.chrome.com/docs/extensions/mv3/sandboxingEval/>
>>>>
>>>> Cheers!
>>>>
>>>
>
> --
> You received this message because you are subscribed to the Google Groups
> "Chromium Extensions" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to chromium-extens...@chromium.org.
> To view this discussion on the web visit
> https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/7ffa8120-8299-4883-874a-1852dca2f7fan%40chromium.org.
>

[W.Help]

Yes, agree.

In my use case, I need an isolated sandbox in background, which like an event page, to help me do some "so-called dangerous" eval() on message, to determine whether I should show a badge on active tab change and do some cache in local storage by parsing bunch of text in the content page (and yes, the sandbox can't work on content script as well, but I accept that is correct.).
But now what I can work with the sandbox is only to do it in "popup.html" when user open the popup.

I would prefer either we can access a "pseudo page of sandbox.html" in service worker triggered by "background.js", or we can add "sandbox.js" in "manifest.json", so that the sandbox could be a real useful sandbox.

[Gaurang Tandon]

Bumping this question, as  I cannot find any MV3 compatible sandbox implementation yet.

The implementation docs on this topic are for MV2 only. The sample referred to in that doc is on GitHub. In this sample, the event page html loads the sandbox html. However, there is no html possible for MV3 service workers. There is another similar sample in the repository with the same issue.

So how do we load the sandbox from a service worker? (assuming there is also no way to load them from a content script on the active tab)
I do not wish to open an extra tab in the browser just to perform some computations in the sandbox.

[Simeon Vincent]

So how do we load the sandbox from a service worker? (assuming there is also no way to load them from a content script on the active tab)

At the moment you can't, but we are working on adding support for "offscreen documents" to Manifest V3 (issue 1339382). 

Simeon - @dotproto

Chrome Extensions DevRel

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/c5112309-d84d-49a3-99d6-cb0b6abd70f5n%40chromium.org.

[Simeon Vincent]

I forgot to mention that we also currently have a bug (issue 1220994) that prevents extensions from relaxing the sandboxed page CSP in order to load remote resources in a sandboxed page. 

Simeon - @dotproto

Chrome Extensions DevRel

[thdoan]

@dotproto I hope we'll be able to execute arbitrary JS code strings like in the chrome.scripting.registerUserScripts(...) example in Rob--W's post at https://github.com/w3c/webextensions/issues/279#issuecomment-1309614401

Is that where the extensions team is heading?

[Gaurang Tandon]

Bumping this thread again after a while. Chrome team recently added MV3 samples for sandbox (link here) as well as updated their sandboxing docs for MV3 (link here). Thanks for that!

The samples run sandboxed code in the foreground tab, but my use case is to run sandboxed code in the background. So, is it supported to load sandboxes in the offscreen documents? I haven't been able to to test this myself yet. It would be nice to see a sample showcasing that.

[Jackie Han]

is it supported to load sandboxes in the offscreen documents? I haven't been able to to test this myself yet. It would be nice to see a sample showcasing that.

Yes, it supports. You can think of mainpage.html (in the samples) as an offscreen document.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/54ba81ec-9859-44b8-b5dc-310eb1b6a52cn%40chromium.org.