SchoologyPlus icon indicating copy to clipboard operation
SchoologyPlus copied to clipboard

Published 20 hours ago • verified publisher icon aopell

Restrict APIs exposed from background page to content script

Open glen3b opened this issue 4 years ago • 2 comments

Chrome security recommendations essentially say that, as a background page, one should distrust content scripts. We currently expose a fairly broad "fetch via background" API to our content scripts, which explicitly goes against their recommendations. We should evaluate the security implementations here and trim down our API as needed.

glen3b avatar Oct 19 '20 23:10 glen3b

Where's this change needed? I'd assume the notification badge bit is one of them.

Roguim avatar Oct 19 '20 23:10 Roguim

fetchApiJson in preload.js is the one which comes to mind. Anywhere we use Schoology API calls this function.

glen3b avatar Oct 23 '20 21:10 glen3b