From 6e80d3f130773fc9a9123c5c4c2e97d63e90fa2a Mon Sep 17 00:00:00 2001
From: hackademix
Date: Sun, 26 Aug 2018 17:43:01 +0200
Subject: Let content script inject failsafe CSP in the DOM.

---
 src/content/content.js | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'src/content/content.js')

diff --git a/src/content/content.js b/src/content/content.js
index 8ab3654..a5d996d 100644
--- a/src/content/content.js
+++ b/src/content/content.js
@@ -61,14 +61,21 @@
       
       if (!this.perms.DEFAULT || this.perms.tabInfo.unrestricted) {
         this.allows = () => true;
+        this.capabilities =  Object.assign(
+          new Set(["script"]), { has() { return true; } });
+      } else {
+        let perms = this.perms.CURRENT || this.perms.DEFAULT;
+        this.capabilities = new Set(perms.capabilities);
+        new DocumentCSP(document).apply(this.capabilities);
       }
       ns.fire("perms");
     },
     perms: { DEFAULT: null, CURRENT: null, tabInfo: {}, MARKER: "" },
+        
     allows(cap) {
-      let perms = this.perms.CURRENT; 
-      return perms  && perms.capabilities.includes(cap);
+      return this.capabilities && this.capabilities.has(cap);
     },
+    
     getWindowName() {
       return top !== window || !this.perms.MARKER ? window.name
         : window.name.split(this.perms.MARKER + ",").pop();
-- 
cgit v1.2.3