Skip to content

"Pick an element from the page" broken in Firefox 152+ due to executeScript deprecation #94

@Rob--W

Description

@Rob--W

executeScript in extension documents has been deprecated since 149 and is removed in Firefox 152.

For context:

Your extension appears to be opening inspectView.html and uses tabs.executeScript to invoke some logic there. This use of executeScript will cease to work in Firefox 152, so I recommend switching to an alternative. To address this, you could use runtime.onMessage in your inspectView.html and then use tabs.sendMessage to communicate with it instead.

But when I see what your extension is doing, it looks a bit concerning - you are taking the URL of the original web page, passing that URL to inspectView.html which fetches the document and then embeds the HTML directly in your extension document. That is a very insecure way to load HTML (and also causing privacy issues). The only fortunate part is that the XSS impact is somewhat mitigated by the default CSP that restricts script execution (script-src 'self').

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions