Posts

Showing posts with the label Firefox

Workarounding the "remote code execution" constraint

Firefox has done it before Chrome some time ago: most addons evaluating Javascript code which is not included in the addon package will get a very hard time from Firefox reviewers. Currently, it is still possible with Chromium based browsers. However and webstore-wise there is a strong chance for your addon to stay significantly longer in the "pending review" status  (weeks?) if the review system detects any sign or evidence of remote code execution. With the arrival of manifest V3 (currently under development) , calls to eval("jscode") , new Function("jscode") and chrome.tabs.executeScript({code: "jscode")) won't work anymore. Let's face it, there is no solution to this problem and this will impact all the scripting addons, among them the famous TamperMonkey with 10M+ users... but you can still benefit of the JS syntax and (partially) workaround those limitations in certain situations. Here is how...  What if you used a sandboxed js inte...

WebExtensions : the converged future of browser addons

Firefox since FF48 is now proposing the Webextension API which allow to reuse chrome code and APIs with little changes making chrome addons code "99% compatible" with Firefox. Note that Edge the last Windows browser also accepts chrome-like APIs. Hints: - there are a couple of modifications that still need to be brought to the chrome addon repo to make them totally usable in the Firefox context: 1/ locales 2/ manifest.json 2.1 gecko id This one is required by the AMO website to allow registration. Firefox contrary to Chome uses a string id to uniquely identify an addon. 2.2 gecko update_url Don't forget to set this property if you don't host your addon on the AMO site ! 2.3 web_available_resources The chrome manifest file admits wildcards for making resource available, this is not the case for Firefox where you have to explicit mention file names. 3/ some APIs like "notifications" claimed as supported by Firefox...