Is the google chrome extension I made insecure in any way? [closed] - javascript

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 4 days ago.
Improve this question
my organization uses cisco finesse and when we connect to the phones from home, we use a nailed connection to our cell phones. When you receive a call in finesse, there is no audible queue meaning no ringing at all when you get a call. There are server side solutions in cisco documentation, however, my IT department has refused to do anything about it. This problem affects hundreds of users but there is no interest in fixing it.
Que me, the greenest developer on these forums, trying to find a solution for my office. I am learning about the request response cycle, php, java, css and html... and I see a get request in chrome developer tools that comes in all the time when you get a call, so I figured out how to write a chrome extension in javascript to solve the ringing problem by playing a sound when that get request gets sent. Here is the code. Please let me know if it is insecure or if I should change it in any way to make it better. My mp3 is from Spaceballs if that matters.
`background.js:
chrome.webRequest.onBeforeRequest.addListener(
function(details) {
if (details.method === 'GET' && details.url === 'my url is here') {
var audio = new Audio('ringtone.mp3');
audio.play();
}
},
{urls: ['<all_urls>']},
['blocking']
);
` Manifest:
{
"manifest_version": 2,
"name": "Make finesse ring",
"version": "1.0",
"description": "Plays a sound when a specific GET request is made.",
"permissions": [
"webRequest",
"webRequestBlocking",
"my url is here "
],
"background": {
"scripts": ["background.js"],
"persistent": true
}
}`

Related

Chrome extension script not triggering on navigation but only on refresh on willhaben.at

I am currently learning js and dom manipulation and I am trying to figure this out since about 24 hours. By now I am completely clueless. I have the following (below) code where I try to DOM manipulate willhaben.at to inject it with some additional information.
The injection only works when I refresh the page or open it in new tab, I know this is because:
The Chrome extension content script will only load when a completely new webpage matching the URL specified in your manifest is loaded. In this era of single page web applications, many websites, including GitHub, use Javascript frameworks and Ajax calls to only update parts of the existing webpage content as the user navigates around the site. Even though the address bar is being updated, most of the time no actual page loads are being executed, so your chrome extension won't trigger.
My manifest:
{
"manifest_version": 3,
"name": "WH",
"version": "1.0",
"description": "...",
"icons": {
"32": "icon.png"
},
"content_scripts": [
{
"matches": ["*://www.willhaben.at/iad/kaufen-und-verkaufen/d/*"],
"js": ["wh.js"],
"run_at": "document_end"
}
]
}
An example script:
const changeThis= document.querySelector('[data-testid="ad-detail-header"]');
changeThis.innerHTML = 'THIS IS NOT WORKING WITHOUT REFRESHING :(';
I've tried to trigger my script if the url changes, I've tried mutationObserver and probably many other things I don't even remember. I can't even get a darn log in to the console after I navigate without a refresh.
I am pretty sure it is something banal but I can't seem to be able to figure it out. Sorry if you would need code snipes of what I've tried by now but I didn't save all the trials I did and it would be a freaking large amount of code snippets.
(before posting I went trough all of the "Review questions already on Stack Overflow to see if your question is a duplicate." but non of them solved my issue on this site. However I tried the below two after while going trough the list)
document.addEventListener("pjax:end", function() {
console.log('pjax:end');
});
Manifest:
"matches": ["*://*.willhaben.at/*"],
Does not work either.

'webRequest' event listener immediately failing in Chrome Extension [duplicate]

This question already has answers here:
"No matching signature" error on adding a chrome.webRequest listener
(1 answer)
Persistent Service Worker in Chrome Extension
(7 answers)
Closed 7 months ago.
My Goal
To write a browser extension which can use the webRequest permission. It needs to listen to the onResponseStarted event and read the response headers for the Content-Type. Based on specific content types, it will inject a content script that changes the content on the page.
Also, if there is an easier way to get the response headers, that would be preferred over getting this to work. See below for what I've already found.
My current position
Since I have only started on the extension, it is very simple. This is my manifest.json
{
// ... clutter like name and version removed ...
"manifest_version": 3,
"author": "Lakshya Raj",
"background": {
"service_worker": "handler.js"
},
"permissions": [
"webRequest"
]
}
And my handler.js
chrome.webRequest.onResponseStarted.addListener(function(details){
console.log(details);
});
I am on Windows 10, Google Chrome Version 103.0.5060.134 (Official Build) (64-bit).
Error(s)
In the extensions page, there are two errors listed for my extension (installed via "load unpacked")
(Warning) Service Worker Registration Failed. This shows a preview of my extension manifest with the text "handler.js" highlighted. No other information is provided.
(Error) Uncaught TypeError: No Matching Signature. This has two sections, context and stack trace. The content reads "extensions::webRequestEvent" (without formatting), while stack trace reads "Nothing to see here, move along."
Those aren't very useful error messages (at least to me), but that's all it says. I'm assuming someone on Stack Overflow has come upon this before and has a solution.
What I'm expecting
I expect that the details to be logged into the console when I navigate to a page, say https://stackoverflow.com/robots.txt. When the service worker is registered without errors, I can visit the extensions page page and click the link that reads "service worker". That takes me to the console where the output appears.
Stuff I've already researched
Apparently, it is really difficult to get response headers, but on continual search, I came upon this extension called Charset. Charset is able to get the response headers (as part of the functionality code), and it uses webRequest to do so. For this reason, I am trying the webRequest permission in my code. I also looked through the webRequest documentation and did a few unsuccessful Google searches.

Is it possible to ask for password when enable false or removing chrome extension?

I'm kinda new in developing chrome extension. My extension is actually about blocking some web pages, where user can insert domain names of websites that he/she want to block so that children cannot see the page, such as adult content pages, etc.
But I'm facing a problem with the question "How if the children unable or remove the extension, or even unchecked the 'allow in incognito'?" Then it would all be useless. So I am searching for a way to solve this problem, probably with using password before unable/remove the extension/unchecked the 'allow in incognito'.
Here is my manifest file:
{
"manifest_version": 2,
"name": "AmanNet",
"description": "Extension ini memblok halaman yang dianggap berbahaya secara konten html.",
"version": "1.0",
"browser_action": {
"default_icon": "icon_16x16.png",
"default_popup": "popup.html",
"default_title": "AmanNet"
},
"options_page": "pengaturan.html",
"background": {
"scripts": ["background.js"],
"persistent": true
},
"icons": {
"128": "icon_128x128.png"
},
"permissions": [
"http://*/*", "https://*/*", "tabs"
],
"content_scripts": [
{
"matches": ["http://*/*", "https://*/*"],
"exclude_matches": ["http://*.google.com/*","https://*.google.com/*"],
"js": [
"content.js"
],
"run_at": "document_start",
"all_frames": false
}
]
}
How am I going to do this? Should I add something to manifest, or else? Please help.
Your problem is not solvable with a Chrome Extension in the general case.
Google has made every step possible in the direction of making the user empowered to remove unwanted extensions. This is because extensions are a notorious malware vector.
For instance, there is a method for external software to install their extensions through the registry. Since it was introduced, the following measures were taken:
Only extensions hosted on the Web Store are allowed (to enable takedowns by Google)
The user will be expressly asked whether they want that extension activated.
If they decline or uninstall the extension, it will be blacklisted on that profile and cannot be installed via registry again.
There are exceptions to the rule: enterprise installs. An extension on ExtensionInstallForcelist domain policy cannot be uninstalled or deactivated. This is, however, not an option for most users.
You can do some clever hacks with 2 separate extensions and management API, but you can't prevent uninstall, only detect it.
Note that Chrome includes a feature called "supervised users". However, it has its problems - it deals with the question of unwanted extensions/apps by just blanket banning all of them. If I was to set up parental control, I wouldn't accept a solution that would not allow AdBlock.
Bottom line: there is no chance preventing extension uninstall by extensions themselves, and no "good" ways of doing so with external programs. Custom parental control can only be effective if implemented outside Chrome (and even then questionably effective).
Typically you won't be able to prevent removal of any extensions. Chrome does have a "Kiosk" mode which is designed to be tamper proof but is only for Chrome OS: https://developer.chrome.com/apps/manifest/kiosk_enabled
There is no protection against removal. But you could use some steganography/obfuscation technics, like embedding your extension in another one.

Google Chrome App - check if app or regular site

I am working on project which will run as Chrome App & regular site.
How can I test/check in my JS if I am in an Chrome App? (i.e. some functionality will only work under chrome)
Just FYI, here is my Chrome App manifest, please note I am running this in the developer mode (directly from the source, not packaged yet)
{
"manifest_version": 2,
"name": "Example KIOSK APP",
"version": "1.1",
"icons": {
"16": "images/icon-16.png",
"48": "images/icon-48.png",
"128": "images/icon-128.png"
},
"app": {
"background": {
"scripts": ["background.js"],
"persistent": true
}
},
"kiosk_enabled": true,
"offline_enabled": true,
"permissions": [
"system.display",
"power",
"webview",
"fileSystem",
"alwaysOnTopWindows",
"system.storage",
"<all_urls>"
]
}
Any suggestions much appreciated.
Turns out the question meant to distinguish between identical code running in a webpage and inside a (regular) Chrome App window.
It is enough to test for Chrome App APIs that are never exposed to regular pages. An example of that would be to test for app.runtime:
if (window.chrome && chrome.app && chrome.app.runtime) {
// Running inside a Chrome App context
} else {
// Either not Chrome, or not as an app window
}
Edit: This answer turned out not to be relevant to this particular question, but I think I will leave this in case someone stumbles upon this question with a hosted app.
I assume that by "run as Chrome App" you mean a hosted Chrome App.
In this case, it is enough to check chrome.app.isInstalled from the website's code. It's not easy to find this in the documentation, as it was apparently left out as some point, but I will put this as a reference. I just checked and it still works.
So:
// Website code
if (window.chrome && chrome.app && chrome.app.isInstalled) {
// App is installed
} else if (chrome) {
// In Chrome, but app is not installed: offer inline install?
} else {
// Not in Chrome at all
}
I am searching for a way to know, if Chrome was started with --app=https://example.com (so in single page mode) or as full browser (with tabs, menu, etc.).
The answers above don't seem to apply in this case, as it is not an "installed" app. (Chrome app supported was discontinued, right?)
Is there a way to detect, if the page is was opened with --app?

continuous video stream call using html5 [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question appears to be off-topic because it lacks sufficient information to diagnose the problem. Describe your problem in more detail or include a minimal example in the question itself.
Closed 8 years ago.
Improve this question
i want to call function aaP() continuously so that other pages of same site gets the same VISUAL but gets called only at page load
var video = document.querySelector('video');
if (navigator.getUserMedia) {
navigator.getUserMedia({ audio: true, video: true }, function (stream) {
setTimeout(function () { aaP(window.URL.createObjectURL(stream)); }, 99);
}, errorCallback);
}
function aaP(aapV) {
alert(5);
var xmlHttp = new XMLHttpRequest();
xmlHttp.onreadystatechange = function () {
if (xmlHttp.readyState == 4 && xmlHttp.status == 200) {
video.src = window.URL.createObjectURL(stream);
}
}
xmlHttp.open("GET", "WebForm1.aspx?res=aa &mssg=" + aapV, true);
xmlHttp.sen
Your code seems to be incomplete. Maybe you could detail a bit further what you want to achieve. If I understand your question correctly you want to keep the video/audio capture running while a user navigates through different pages of your site and that with no interruption. Correct?
This is not possible by design because Javascript gets executed when a page loads. So if you move to another page of your website the previously existent JavaScript objects will be destroyed and rebuilt on your new page.
Your best approach could be to keep your users on the same web page and then refresh the content of this page with Ajax as they navigate through the different sides of it.
EDIT: for video conferencing you could have a look at WebRTC. Those 2 articles should get you on the right track. Here and here. WebRTC will work great for one to few, one to one, few to few. If you need to support more concurrent connections you can have a look at Licode. There is also tokbox but that one needs to be paid for.

Categories

Resources