Kusagadzikana kunobvumira Chrome ma-add-ons kuti aite ekunze kodhi kunyangwe mvumo

rakabudiswa nzira inobvumira chero Chrome add-on kuti iite yekunze JavaScript kodhi pasina kupa iyo yekuwedzera-yekubvumidza mvumo (isina kuchengeteka-eval uye isina kuchengetedzeka-inline mu manifest.json). Mvumo inoreva kuti pasina kusachengeteka-eval iyo yekuwedzera inogona chete kuita kodhi iyo inosanganisirwa mukugoverwa kwenzvimbo, asi iyo yakarongwa nzira inoita kuti zvikwanise kunzvenga ichi chirambidzo uye kuita chero JavaScript yakarodha kubva kune yekunze saiti mumamiriro ekuwedzera- on.

Parizvino Google yakavhara kupinda kweveruzhinji dambudziko report, asi mudura kuchengetedza sampuli kodhi yekushandisa dambudziko. Way zvakafanana nzira yekunzvenga iyo script-src 'yega' kuganhurirwa muCSP uye inowira pasi kutsiva script tag kuburikidza document.createElement('script') uye kusanganisira zvekunze zvirimo kuburikidza nekutora basa, mushure meizvozvo kodhi ichaitwa mukati. mamiriro ekuwedzera-on pachayo.

Source: opennet.ru