Is Custom User or Remote CSS Allowed in MV3?

[CB]

Hi,

This (newer) official document states that remotely hosted code (RHC) "does not include data or things like JSON or CSS."

However, in the CWS Developer Dashboard before you submit an item, under "Privacy," it has been listing CSS together with JS and Wasm as remote code: "Remote code is any JS, Wasm or CSS that is not included in the extension's package."

What is the actual policy? Also, would either of the code samples below, which inject user-supplied or remotely obtained CSS strings, be approved by the CWS review team?

// Content script (dynamically created style element)

const style = document.createElement("style");

style.textContent = userOrRemoteCssString;

document.head.appendChild(style);

// Service worker (injection via insertCSS)

chrome.scripting.insertCSS({ target : { tabId : getTabId()}, css : userOrRemoteCssString });

Thank you very much.

[wOxxOm]

They must have meant CSS files used in extension page e.g. <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/boot...@3.4.1/dist/css/bootstrap.min.css">

Otherwise it would mean they want to kill all userstyle extensions that install user-supplied CSS.

[Patrick Kettner]

It is actually just wrong. Originally there had been a plan to not allow for remote CSS, but we successfully changed that quite a while back. The code that the developer dashboard is getting that string from is just out of date.

Thanks a lot for pointing it out! I've submitted a fix for it.

patrick

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/ea220a89-2e13-42f9-9118-f7bf63bd151fn%40chromium.org.