excalidraw icon indicating copy to clipboard operation
excalidraw copied to clipboard

Unable to use excalidraw in browser extension [CSP lvl. 3]

Open krzysztofMlczk opened this issue 2 years ago • 0 comments

I am trying to use excalidraw inside chrome extension that injects excalidraw into a webpage but I am not able to due to strict CSPs. Excalidraw depends on some remote resources from https://unpkg.com/ but it is mentioned in the documentation that it is possible to host those files by myself. And that is what I am doing in my extension. However in order to make excalidraw actually use the local version of those files instead of the remote one I need to set window.EXCALIDRAW_ASSET_PATH to chrome.runtime.getURL("") (that's where these files reside) but it is not possible as fetching of those resources happens from the top level window (the webpage) and not content script. I cannot set global variables of the webpage as extensions content sripts live in an isolated world, where only DOM is shared between content script and the webpage. I tried to set this variable by injecting inline script (since DOM is the only shared thing) but this is not allowed due to strict CSPs of chrome extensions. I really do need a way to force excalidraw to use my local resources but I don't want to modify code of the library.

krzysztofMlczk avatar Feb 06 '24 09:02 krzysztofMlczk