[Bug]: Potential CSP Issue in Chrome 130

[shikhir-arora]

Version

0.0.1.5-PUBLIC-BETA

Describe the bug

I wanted to express my gratitude for creating such an excellent extension that is open-source, well-documented, clean, and lightweight.

I typically use Chrome Canary as my daily browser. However, a recent change in CSP policies or how the browser handles them seems to be affecting the loading of the Complexity extension. I used the extension for a few days, and it worked perfectly. However, currently, only the CSS injection seems to be working. I have attached several relevant screenshots below. I have also tried everything in Incognito Mode with no other extensions enabled.

I appreciate the effort you've put into this project. Please let me know if you can reproduce this issue. 🙂

Steps to reproduce

Please take a look at the screenshots below! 👍

Bug confirmation

• I am not able to reproduce the issue with the extension disabled
• I have re-installed the extension and the issue persists

Expected behavior

Normal behaviour, i.e:

Screenshots

Browser

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Additional context

No response

[pnd280]

ce9242a should fix the issue. The fix is somewhat hacky since @crxjs/vite-plugin doesn't have an option to disable use_dynamic_url, which is most likely the cause that triggers the CSP

https://github.com/pnd280/complexity/releases/tag/v0.0.1.6-alpha

[shikhir-arora]

@pnd280 - Thank you, it works great! 👍

[bruceeewong]

@pnd280 Hey, first of all, thank you for the brilliant hack, it worked for build version. However, for dev mode, crxjs would always append an entry of web_accessible_resources, which causes the extension fail to be loaded by the latest Chrome. Do you have the same issue?

{
  "matches": ["<all_urls>"],
  "resources": ["**/*", "*"],
  "use_dynamic_url": true
}

[pnd280]

@pnd280 Hey, first of all, thank you for the brilliant hack, it worked for build version. However, for dev mode, crxjs would always append an entry of web_accessible_resources, which causes the extension fail to be loaded by the latest Chrome. Do you have the same issue?

{
  "matches": ["<all_urls>"],
  "resources": ["**/*", "*"],
  "use_dynamic_url": true
}

my solution works for both dev and build env, as long as it purges all "use_dynamic_url": trues

[Ang-l]

@pnd280 Hey, first of all, thank you for the brilliant hack, it worked for build version. However, for dev mode, crxjs would always append an entry of web_accessible_resources, which causes the extension fail to be loaded by the latest Chrome. Do you have the same issue?

{
  "matches": ["<all_urls>"],
  "resources": ["**/*", "*"],
  "use_dynamic_url": true
}

my solution works for both dev and build env, as long as it purges all "use_dynamic_url": trues

@pnd280 Hello, the solution I used from you still cannot solve it.

[pnd280]

@Ang-l please continue discussion in the original issue crxjs/chrome-extension-tools#918