Skip to content

"Pick an element from the page" broken in Firefox 152+ due to executeScript deprecation #94

Description

@Rob--W

executeScript in extension documents has been deprecated since 149 and is removed in Firefox 152.

For context:

Your extension appears to be opening inspectView.html and uses tabs.executeScript to invoke some logic there. This use of executeScript will cease to work in Firefox 152, so I recommend switching to an alternative. To address this, you could use runtime.onMessage in your inspectView.html and then use tabs.sendMessage to communicate with it instead.

But when I see what your extension is doing, it looks a bit concerning - you are taking the URL of the original web page, passing that URL to inspectView.html which fetches the document and then embeds the HTML directly in your extension document. That is a very insecure way to load HTML (and also causing privacy issues). The only fortunate part is that the XSS impact is somewhat mitigated by the default CSP that restricts script execution (script-src 'self').

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions