Skip to content

RFC: Use a separate script injected into the page context

Fabian Vogt requested to merge work/pagescriptpoc into master

Instead of running single snippets on demand, have a single script which can perform all the needed actions for us. This is compatible with Firefox's enforcement of Content-Security-Policy for injections by content-scripts.

Use events for bidirectional communication. As the various actions now share a context, also get rid of the global objects.

The first commit used a different mechanism, it re-injected the script for each call and passed data using dataset on the injected script element. This resulted in pretty much identical behaviour to before, but using events for that seemed cleaner to me. Do you agree?

I tested this a bit and it appears to work on both Vivaldi and Firefox now, even with Content-Security-Policy: script-src 'none'.

The behaviour with extension reloads changes a bit. I noticed that it can't deal well with registering the MediaSessions shim twice, which happens on extension reloads currently, which is unchanged. However, the page script stays loaded and the event listener attached, and I couldn't find a way to unregister the listener from the old page-script from the new one. So after an extension reload, the old page-script gets the events from the content-script :-/

This is addressed now by the "Manage lifetime of page-script.js" commit. There is no way to tell that a content-script is being unloaded on Firefox (https://bugzilla.mozilla.org/show_bug.cgi?id=1223425), so it just unloads the old page-script unconditionally from the new content-script instance.

Now we have plasma-browser-integration-host <-> background script <-> content script <-> page script :D

Edited by Fabian Vogt

Merge request reports