Cannot embed content script into an extension.

[Naveen.B]

Hi,
Can somebody please clarify why a content script cannot be embedded
into another extension?
I see that a content script can only be embedded into a web page .
What are the security reasons behind taking this approach?
When I add chrome-extension://<path> to permissions in manifest.json,
I see error like scheme chrome-extension cannot be read.

Regards,
Naveen.B

[Ben]

I imagine they don't want malicious extensions having access to data in
other extensions without permission. One example would be if an
extension was able to gain access to LastPass's internal pages, it would
potentially have access to all of your password information.

If you want access to certain information within another extension, it
would be better to either ask the author to either use an
chrome.extension.onExternalRequest listener and provide a public API to
access the data, or use an onExternalRequest listener and verify that
it's your extension accessing the data by checking the requesting
extension's ID. Once that is implemented, you can use
chrome.extension.sendExternalRequest to get information from the
extension.

[Naveen]

Thanks Ben.
The same could hold good for a web page into which we would be injecting a content script. An extension could as well corrupt a web page . 
But since there are limitations to content scripts as they run in isolated world would handle these security considerations .
By injecting inside an extension don't you think the security measures still hold good.
My requirement is to just modify the DOM of an extension.

I have made changes inside chrome native code to allow which would allow  me to add chrome-extension permission set in manifest.json.
This would enable my content script to get added to an extension also. Do you think its right to do that? Please provide your views.

Regards,
Naveen.B

[Arne Roomann-Kurrik]

I think this would be a bad idea.  If you were able to inject code into an extension with more privileges than your own extension, that would be a privilege escalation exploit.

~Arne

--
You received this message because you are subscribed to the Google Groups "Chromium-extensions" group.
To post to this group, send email to chromium-...@chromium.org.
To unsubscribe from this group, send email to chromium-extens...@chromium.org.
For more options, visit this group at http://groups.google.com/a/chromium.org/group/chromium-extensions/?hl=en.

[Naveen]

Hi Arne,
Can this use case be accounted for by checking at the native code level?

Regards,
Naveen.B

[Naveen]

Any thoughts on this. Can we make extensions embed content scripts to extensions by restricting some aspects in the chrome native code?
What are the implications of doing this?

[Arne Roomann-Kurrik]

Honestly, I doubt this is the kind of thing that the team would want to have special case code in place for.  But you can follow these steps to request the feature officially: http://code.google.com/chrome/extensions/faq.html#faq-fea-02

~Arne

[Naveen]

Thanks.
I have added this.
http://code.google.com/p/chromium/issues/detail?id=92614