feat: manifest CSP

ThaUnknown · ThaUnknown · commit 2db1ea762628 · 2022-09-16T20:31:59.000+02:00
diff --git a/background.js b/background.js
@@ -12,6 +12,8 @@ chrome.webRequest.onHeadersReceived.addListener(({ responseHeaders, url }) => {
     for (let p of cspAllowAll) {
       csp.value = csp.value.replace(`${p}`, `${p} * blob: data:`); // * does not include data: URIs
     }
+    // Discord doesn't even specify a manifest CSP so we create our own
+    csp.value += ' manifest-src * blob: data:;'
 
     // Fix Discord's broken CSP which disallows unsafe-inline due to having a nonce (which they don't even use?)
     csp.value = csp.value.replace(/'nonce-.*?' /, '');

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,8 @@ chrome.webRequest.onHeadersReceived.addListener(({ responseHeaders, url }) => {`
`12`	`12`	`for (let p of cspAllowAll) {`
`13`	`13`	csp.value = csp.value.replace(`${p}`, `${p} * blob: data:`); // * does not include data: URIs
`14`	`14`	`}`
	`15`	`+ // Discord doesn't even specify a manifest CSP so we create our own`
	`16`	`+ csp.value += ' manifest-src * blob: data:;'`
`15`	`17`
`16`	`18`	`// Fix Discord's broken CSP which disallows unsafe-inline due to having a nonce (which they don't even use?)`
`17`	`19`	`csp.value = csp.value.replace(/'nonce-.*?' /, '');`