remote CSS

[Nathan Peterson]

It's well-known that MV3 prohibits remote code loading but I'm curious if remote CSS files are also prohibited. We've run into a number of bugs that were CSS-only issues and this capability would be very useful to us if permitted.

[Robbi]

I've always used "google material icons" and "font-awesome" by calling these resources with a <link rel="stylesheet" href="https://..."> tag in my html files without problems and without declaring anything in the manifest.json.

Is this what you meant?

[Nathan Peterson]

Not exactly what I'm picturing. This would be CSS that gets injected into the host page to style UI that gets added via content script.

One potential implementation would be storing the CSS on the server, fetching it at the moment the content script gets injected, and adding a style tag to the hostpage document head with the `textContent` set to the downloaded CSS. Curious if this would get flagged in a review as "remote code loading" or not.

[Patrick Kettner]

CSS is considered content, rather than code. But the policy does allow for a reviewer to use their best judgement. I would not anticipate it to be a problem, but it is possible depending on the specifics of the code being used.

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/b57e91ca-39ed-4640-9ad9-0528038f1d85n%40chromium.org.

[wOxxOm]

Depending on what exactly you are doing it may be a bug or intended behavior e.g. site's CSP naturally applies to LINK elements created in MAIN world.