Using lodash in browser extension #5934
Description
Hi,
I'm trying to inject a content-script from a browser extension.
The script uses ckeditor5 which uses lodash-es.
The whole content-script is bundled using 'rollup' before use.
The content-script works fine in the Chrome browser, but not in Firefox.
The failure seems to be with respect to the use of lodash.
I have detected two issues,
- code from
_root.js
/** Detect free variable `self`. */
var freeSelf = typeof self == 'object' && self && self.Object === Object && self;
/** Used as a reference to the global object. */
var root = freeGlobal || freeSelf || Function('return this')();
In Chrome, freeSelf is detected - seems to be the value window.
However, in Firefox freeSelf & freeGlobal are false and thus the scrip tries to execute Function('return this')() which is not allowed by CSP in the context of a content-script.
- If I replace the
Function('return this')()withwindow
I the get a failure withnew DataView(new ArrayBuffer(1))from_getTag.js
Error: Permission denied to access object
any suggestions or help gratefully received.
thanks