Merge pull request #147 from yakisova41/trusted-inject

✨ Feature trusted inject mode
yakisova41 · Aug 4, 2024 · 42b3c23 · 42b3c23
2 parents 57a4cb0 + a4e3fb4
commit 42b3c23
Show file tree

Hide file tree

Showing 6 changed files with 31 additions and 6 deletions.
diff --git a/dev/manifest.js b/dev/manifest.js
@@ -19,6 +19,7 @@ const manifest = {
       connection_isolated: true,
       userscript_direct_inject: true,
       bind_GM_api: true,
+      trusted_inject: true,
     },
     {
       matches: ['https://www.google.com/*'],

diff --git a/packages/crx-monkey/src/node/handlers/UserScript.ts b/packages/crx-monkey/src/node/handlers/UserScript.ts
@@ -86,6 +86,7 @@ export class UsersScript {
     directInject: boolean = false,
     bindGM: boolean = false,
     defineGMHash: string | false = false,
+    trusted_inject: boolean = false,
   ) {
     const syntaxs = {
       document_end: {
@@ -143,9 +144,19 @@ export class UsersScript {
         }
 
         functionNames.forEach((name) => {
-          directScriptContent.push(
-            `script.innerHTML = script.innerHTML + \`(\${${name}.toString()})();\``,
-          );
+          if (trusted_inject) {
+            directScriptContent.push(
+              'const policy = window.trustedTypes.createPolicy("crx-monkey-trusted-inject-policy", {createScript: (input) => input,});',
+            );
+
+            directScriptContent.push(
+              `script.text = policy.createScript(script.text + \`(\${${name}.toString()})();\`)`,
+            );
+          } else {
+            directScriptContent.push(
+              `script.innerHTML = script.innerHTML + \`(\${${name}.toString()})();\``,
+            );
+          }
         });
 
         directScriptContent.push('unsafeWindow.document.body.appendChild(script)\n');

diff --git a/packages/crx-monkey/src/node/handlers/build/BuildUserScript.ts b/packages/crx-monkey/src/node/handlers/build/BuildUserScript.ts
@@ -259,8 +259,16 @@ export class BuildUserScript extends Build implements BuildImplements {
 
     if (contentScripts !== undefined) {
       contentScripts.forEach((contentScript) => {
-        const { matches, js, css, run_at, exclude_matches, userscript_direct_inject, bind_GM_api } =
-          contentScript;
+        const {
+          matches,
+          js,
+          css,
+          run_at,
+          exclude_matches,
+          userscript_direct_inject,
+          bind_GM_api,
+          trusted_inject,
+        } = contentScript;
 
         let thisContentScriptCode = '';
 
@@ -279,6 +287,8 @@ export class BuildUserScript extends Build implements BuildImplements {
             css,
             userscript_direct_inject,
             bind_GM_api,
+            false,
+            trusted_inject,
           );
 
         // End if.

diff --git a/packages/crx-monkey/src/node/handlers/dev/WatchUserScript.ts b/packages/crx-monkey/src/node/handlers/dev/WatchUserScript.ts
@@ -275,7 +275,7 @@ export class WatchUserScript extends Watch implements WatchImplements {
 
     if (contentScripts !== undefined) {
       contentScripts.forEach((contentScript) => {
-        const { matches, js, css, exclude_matches, bind_GM_api } = contentScript;
+        const { matches, js, css, exclude_matches, bind_GM_api, trusted_inject } = contentScript;
 
         if (matches !== undefined && !matches.includes('<all_urls>')) {
           // Start conditional statement of if for branch of href.
@@ -294,6 +294,7 @@ export class WatchUserScript extends Watch implements WatchImplements {
             false,
             false,
             bind_GM_api === true ? this.bindGMHash : false,
+            trusted_inject,
           );
 
         // End if.

diff --git a/packages/crx-monkey/src/node/manifest-factory/index.ts b/packages/crx-monkey/src/node/manifest-factory/index.ts
@@ -11,6 +11,7 @@ export class ManifestFactory {
     'userscript_direct_inject',
     'connection_isolated',
     'bind_GM_api',
+    'trusted_inject',
   ];
 
   constructor(originalManifest: CrxMonkeyManifest) {

diff --git a/packages/crx-monkey/src/node/types.ts b/packages/crx-monkey/src/node/types.ts
@@ -86,5 +86,6 @@ export type CrxMonkeyContentScripts = Array<{
   userscript_direct_inject?: boolean;
   connection_isolated?: boolean;
   bind_GM_api?: boolean;
+  trusted_inject?: boolean;
   [key: string]: unknown;
 }>;