由于 'unsafe-eval'，Chrome 扩展中的 Javascript Tensorflow 无法正常工作

Question

我正在尝试将我的 Chrome 扩展程序更新为 Manifest v3。我使用 JSTensorflow 模型并弹出此错误:

Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

我知道 Manifest v3 不允许“unsafe-eval”，那么我该如何解决这个问题？

我的 manifest.json:

{
    "name": "Recipick DEVELOPMENT",
    "description": "Pick the recipe from a website",
    "version": "1.0.0",
    "manifest_version": 3,
    "background": {
        "service_worker": "background.js",
        "type": "module"
    },
    "action": {
        "default_title": "Recipick",
        "default_icon": "/images/icon_1.png"
    },
    "permissions": [
        "activeTab",
        "clipboardWrite",
        "sessions",
        "scripting",
        "storage",
        "tabs"
    ],
    "host_permissions": [ "*://*/*" ],
    "content_security_policy": {
        "extension_pages": "script-src 'self'; object-src 'self'"
    },
    "web_accessible_resources":  [{
        "resources": [ "*.gif" ],
        "matches": [ "*://*/*" ] 
    }]
} 

感谢您的帮助!

Answer 1

我刚刚知道怎么做。

如果您在沙盒环境中使用它们，则可以使用“不安全评估”和其他不允许的操作。正如https://developer.chrome.com/docs/extensions/mv3/manifest/sandbox/中所说:

A sandboxed page will not have access to extension APIs, or direct access to non-sandboxed pages (it may communicate with them via postMessage()).

A sandboxed page is not subject to the Content Security Policy (CSP) used by the rest of the extension (it has its own separate CSP value). This means that, for example, it can use inline script and eval.

我创建了一个名为 sandbox.html 的 HTML 页面，并将其插入到我想作为 iframe 处理的页面中，其中嵌入了脚本。然后接收要在那里处理的数据并通过window.postMessage()返回到内容/后台脚本。 (在这种情况下 window.parent.postMessage()，因为它是一个 iframe)。

这是此实现的示例:https://github.com/GoogleChrome/chrome-extensions-samples/tree/main/apps/samples/sandbox .

此页面也可能有用:https://developer.chrome.com/docs/extensions/mv3/sandboxingEval/