是否允许将 javascript 文件从远程服务器注入到页面？
我正在为客户开发一个 Chrome 扩展程序，希望我将远程 javascript 文件嵌入到特定页面中。
这还被允许吗？例如，我知道在 Firefox 中，这样的扩展不会获得 AMO 的批准。
如果允许的话，使其尽可能安全的最佳方法是什么？ （已经使用 https 来阻止中间人攻击）
提前感谢所有人:)
I'm developing a Chrome extension for a client which want me to embed a remote javascript file into specific pages.
Is that even allowed? for instance I know that at Firefox such an extension won't get approved by AMO.
And if it is allowed, what's the best way to make it secure as possible? (already using https to negate man in the middle attack)
Thanks to all in advance :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这并不罕见，许多扩展都这样做，所以如果你小心的话，我不认为你会被拒绝。但是，请务必关注新的 CSP（内容安全策略）更改，这可能会在将来影响此功能：https://mikewest.org/2011/10/secure-chrome-extensions-content-security-policy
截至目前，您可以通过几种方法来完成这：
1）您可以在后台页面使用XMLHttpRequest下载代码，并且可以使用chrome.tabs.executeScript将其注入到网页中。
2) 您可以从内容脚本执行相同的操作，因为内容脚本也可以使用跨域 XMLHttpRequest。
3) 您可以创建一个内容脚本，该脚本在页面中创建一个元素，其中“src”属性指向外部脚本。
额外的安全性
为了使其尽可能安全，https 将是关键。您可以通过实际编码或签署脚本来提供额外的安全级别。例如：
1) 创建公钥/私钥对，公钥包含在扩展中，私钥用于在脚本准备好时对脚本进行编码。
2）在服务器端完成脚本代码，然后用私钥进行编码。
3) 在扩展端，下载脚本“document”，然后用公钥对其进行解码。验证它是否是有效的脚本文件。
这样，您将只接受并执行您知道由私钥所有者签名的脚本。
This is not uncommon, a number of extensions do this, so I don't expect you to be rejected if you are careful. However, do keep an eye on the new CSP (Content Security Policy) changes, which may impact this functionality in the future: https://mikewest.org/2011/10/secure-chrome-extensions-content-security-policy
As of now, there are a few ways you can accomplish this:
1) You can use XMLHttpRequest in your background page to download the code, and you can inject it in the web page using chrome.tabs.executeScript.
2) You can do the same thing from a content script because content scripts can also use cross-domain XMLHttpRequest.
3) You can create a content script that creates a element in the page with the "src" attribute pointing to the external script.
Additional Security
To make it as secure as possible, https would be key. You can provide an additional level of security by actually encoding or signing the script. For example:
1) Create a public/private key pair, the public key is included with the extension and the private key is used to encode the script when it is ready.
2) Finish the script code on the server side, then encode it with the private key.
3) On the extension side, download the script "document", then decode it with the public key. Verify that it's a valid script file.
This way you will only accept and execute scripts that you know were signed by the owner of the private key.