Add CSP to content pages (#44)

Let's add a csp so the extension cannot connect to remote things. Also makes sure to only load .js that is inside the extension, so xss'ing an input field is quite a bit harder :)
mozilla-extensions · Aug 30, 2024 · e332f15 · e332f15
1 parent b16c722
commit e332f15
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 1 deletion.
diff --git a/src/ui/browserAction/popup.html b/src/ui/browserAction/popup.html
@@ -7,10 +7,13 @@
 <!doctype html>
 <html>
   <head>
+    <meta
+      http-equiv="content-security-policy"
+      content="script-src 'self';img-src 'self'; font-src 'self'; connect-src 'none'; media-src 'none'; object-src 'none'; prefetch-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none';"
+    />
     <meta http-equiv="content-type" content="text/html; charset=utf-8" />
     <link rel="stylesheet" href="popup.css" />
     <link rel="stylesheet" href="../variables.css" />
-
     <script src="./popupPage.js" type="module"></script>
     <title>Mozilla VPN</title>
   </head>

diff --git a/src/ui/pageAction/pageActionPopup.html b/src/ui/pageAction/pageActionPopup.html
@@ -8,6 +8,10 @@
 <!doctype html>
 <html>
   <head>
+    <meta
+      http-equiv="content-security-policy"
+      content="script-src 'self';img-src 'self'; font-src 'self'; connect-src 'none'; media-src 'none'; object-src 'none'; prefetch-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none';"
+    />
     <meta http-equiv="content-type" content="text/html; charset=utf-8" />
     <link rel="stylesheet" href="../variables.css" />
     <link rel="stylesheet" href="./pageAction.css" />

diff --git a/src/ui/settingsPage/index.html b/src/ui/settingsPage/index.html
@@ -7,6 +7,10 @@
 <!doctype html>
 <html>
   <head>
+    <meta
+      http-equiv="content-security-policy"
+      content="script-src 'self';img-src 'self'; font-src 'self'; connect-src 'none'; media-src 'none'; object-src 'none'; prefetch-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none';"
+    />
     <meta http-equiv="content-type" content="text/html; charset=utf-8" />
     <link rel="stylesheet" href="../variables.css" />
     <title>Mozilla VPN Settings</title>