1

I was building a chrome extension and used some icons from font awesome. However, those icons aren't loading because of the following error-

enter image description here

For reference, here is the manifest.json file-

{
    "manifest_version": 2,
    "name": "Safe and Secure",
    "description": "Every security tool at one place.",
    "version": "1.0.0",
    "icons": {"128": "logo_128.png"},
    "browser_action": {
        "default_icon": "images/logo.png",
        "default_popup": "index.html"
    }
}
Zaid Ahmad
  • 87
  • 12

1 Answers1

1

Chrome Extensions by default have a Content Security Policy of only files located within the extensions directory as specified here. The reason is so your extension's users are not vulnerable to malicous code that could be brought in from a website.

If you want to use the font-awesome script for icons, you must specify so in your manifest.json.

{
    "manifest_version": 2,
    "name": "Safe and Secure",
    "description": "Every security tool at one place.",
    "version": "1.0.0",
    "icons": {"128": "logo_128.png"},
    "browser_action": {
        "default_icon": "images/logo.png",
        "default_popup": "index.html"
    }
    // add this line
    "content_security_policy": "script-src 'self' https://example.com; object-src 'self'",
}

The above is just an example of how you would bring it in. I would check the website linked above in order to find an example that matches your use-case.

pythonNovice
  • 1,130
  • 1
  • 14
  • 36
  • I added this to manifest.json- `"content_security_policy": "script-src 'self' 'unsafe-inline'; object-src 'self"` and now I am getting two errors- `'content_security_policy': Ignored insecure CSP value "'unsafe-inline'" in directive 'script-src'.` and `'content_security_policy': Ignored insecure CSP value "'self" in directive 'object-src'.` – Zaid Ahmad Aug 18 '21 at 04:39
  • In your case, instead of adding ‘unsafe-eval’ you should be adding the websites domain https://kit.fontawesome.com (include the https:// part). Remember that you are bringing in a remote script so you need to specify from which website you are bringing in the script. – pythonNovice Aug 18 '21 at 11:18
  • Again, its just ignoring the value that i give :( – Zaid Ahmad Aug 19 '21 at 04:33