javascript - 重定向到 Firefox 中的扩展资源

标签 javascript firefox-addon xss

出于开发目的,我正在尝试构建一个扩展,将所有与正则表达式匹配的请求重定向到特定页面。问题是 firefox API 似乎没有执行 chrome.webRequest.onBeforeSendHeaders.addListener 文档中宣传的内容。这是扩展的简化版本:

list .js

{
    "applications": {
      "gecko": {
        "id": "addon@example.com",
          "strict_min_version": "42.0",
          "strict_max_version": "50.*",
          "update_url": "https://example.com/updates.json"
      }
    },

    "name": "Developer",
    "version": "0.1.26",
    "manifest_version": 2,
    "description": "A script useful for development.",
    "icons": {"16": "logo16.png",
              "48": "logo48.png",
              "128": "logo128.png"},
    "background": {
    "scripts": ["background.js"]
    },
    "web_accessible_resources": ["hello.html"],
    "permissions": [
        "activeTab",
        "webRequest",
        "webRequestBlocking"
    ]
}

background.js

// I found somewhere that onBeforeSendHeader it should work but it doesn't.
chrome.webRequest.onBeforeRequest.addListener(
  function(details) {
    var redirect;
    if (details.url.match(/example\.com/)) {
      redirect = chrome.extension.getURL("hello.html");
      console.log("Redirecting:", details.url, "->", redirect);
      return {redirectUrl: redirect};
      }
    console.log("Requesting:",details.url);
  }, {urls: [
    "<all_urls>"
  ]}, ["blocking"]);

hello.html

<html>
    <head>It works</head>
    <body>And it's not apache!</body>
</html>

简而言之,它将从 example.com 获取的所有内容重定向到扩展资源 hello.html

所以我转到 about:config 并将 security.fileuri.strict_origin_policy 设置为 false。然后我转到 about:debugging 并加载扩展。然后我打开浏览器控制台 Tools -> Web Developer -> Browser Console。最后我去了 example.com。我应该得到 hello.html 的内容,但我什么也没得到(白屏),在浏览器控制台中我得到:

Redirecting: "http://example.com/" -> "moz-extension://ce33a9b5-2c20-ed41-b8aa-f52143783c38/hello.html"
Security Error: Content at http://example.com/ may not load or link to file:///path/to/extension/hello.html.

出于个人开发目的,我需要扩展,所以我不介意更改 about:config

编辑:如果我将重定向 url 更改为网络上的内容并将 onBeforeReqeuest 更改为 onBeforeSendHeaders 一切正常:

chrome.webRequest.onBeforeSendHeaders.addListener(
  function(details) {
    var redirect;
    if (details.url.match(/example\.com/)) {
      redirect = "https://www.google.com"; // chrome.extension.getURL("hello.html");
      console.log("Redirecting:", details.url, "->", redirect);
      return {redirectUrl: redirect};
      }
    console.log("Requesting:",details.url);
  }, {urls: [
    "<all_urls>"
  ]}, ["blocking"]);

Edit2:抱歉,这将是一个 WebExtension(虽然我认为这是显而易见的,因为有一个 manifest.json 文件而不是 install.rdf) .还有文档 onBeforeRequestaddListener 部分指出:

Returns: webRequest.BlockingResponse. If "blocking" is specified in the "extraInfoSpec" parameter, the event listener should return an object of this type.

然后在 BlockingResponse文档:

redirectUrl Optional string. Only used as a response to the onBeforeRequest and onHeadersReceived events. If set, the original request is prevented from being sent/completed and is instead redirected to the given URL. Redirections to non-HTTP schemes such as data: are allowed. Redirects initiated by a redirect action use the original request method for the redirect, with one exception: If the redirect is initiated at the onHeadersReceived stage, then the redirect will be issued using the GET method.

最佳答案

这对我来说适用于 chrome 和 firefox。

    let { tabId } = details;
    let redirectUrl = chrome.extension.getURL('hello.html');
    if(navigator.userAgent.toLowerCase().indexOf("firefox") > -1) {
        chrome.tabs.update(tabId, {
            url: redirectUrl
        })
        return {
            cancel: true
        }
    } else return { redirectUrl }

关于javascript - 重定向到 Firefox 中的扩展资源,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/36063233/

相关文章:

javascript - Angular - 如何防止 RxJs fromEvent 中的 XSS 攻击?

javascript - 哪个是正确的 - jsonlint 或 JSON.parse?

javascript - 如何在kango框架中的背景和内容脚本之间传输对象

javascript - Mozilla Firefox 扩展开发。 577 < 100。这怎么可能?

javascript - 允许子域之间的跨站点请求而不更改第二个子域的文件内容

javascript - 防止在输入字段中运行JS代码,然后由JS添加

javascript - 如何在 angular2 应用程序中循环/计数组件?

javascript - Laravel Blade 在 php 中传递 Javascript 变量

javascript - 如何在 TextBox 上使用 JQuery 的拖放功能?

javascript - 读取 list : Error processing options_page: An unexpected property was found in the WebExtension