Injecting a script tag from a content script to an iframe with data URI src throws a 'web_accessible_resources' error even tho it's set correctly

1,014 views
Skip to first unread message

Stiliyan Kushev

unread,
Jul 5, 2022, 10:19:35 AM7/5/22
to Chromium Extensions
I'm working on an extension that injects a piece of code into iframes.

I'm using manifest v3 and I have a content script that injects a script tag with my code into the iframes.

The issue comes when we have an iframe with src set as data URI like so:

`<iframe src="data:text/html;base64,PHNjcmlwd...3NjcmlwdD4="></iframe>`

When the content script injects the custom script tag, unlike all other possible ways to create an iframe element,  this one throws an error saying the script tag is not included in the "web_accessible_resources" even tho it is. (otherwise, all other iframes would fail as well)


Error: [Denying load of chrome-extension://obfggkijinagdggiiigfpppiaoielnjo/src/dest/payload-min.js. Resources must be listed in the web_accessible_resources manifest key in order to be loaded by pages outside the extension.][1]

I believe this is a chrome bug but I'm asking for an alternative way to achieve my goal before contacting the chrome dev group.



**manifest.json:**
```
{
    "name": "My Extension",
    "version": "1.0",
    "manifest_version": 3,
    "incognito": "spanning",
    "background": {
        "service_worker": "background.js"
    },
    "permissions": [
        "browsingData",
        "windows",
        "activeTab",
        "tabs",
        "webNavigation",
        "webRequest",
        "declarativeNetRequest",
        "declarativeNetRequestWithHostAccess",
        "declarativeNetRequestFeedback"
    ],
    "host_permissions": [ "*://*/*" ],
    "content_scripts": [
        {
            "all_frames" : true,
            "run_at" : "document_start",
            "match_about_blank" : true,
            "match_origin_as_fallback": true,
            "matches": ["*://*/*"],
            "js": ["./content-script.js"]
        }
    ],
    "web_accessible_resources": [
        {
          "resources": [ "/src/dest/payload-min.js" ],
          "matches": [ "<all_urls>" ]
        }
    ]
}
```


**content-script.js:**
```
var script = document.createElement('script')
script.setAttribute('class', 'myScriptClass')
script.src = chrome.runtime.getURL('/src/dest/payload-min.js')
;(document.head||document.documentElement).appendChild(script)
```


  [1]: https://i.stack.imgur.com/0zuRz.png

wOxxOm

unread,
Jul 5, 2022, 2:49:11 PM7/5/22
to Chromium Extensions, stiliya...@gmail.com
Reply all
Reply to author
Forward
0 new messages