🐛 针对 WebExtensions API Changes (Firefox 149-152) 做修正 (#1448)

cyfung1031 · CodFrm · web-flow · commit 6dc9c1511977 · 2026-05-19T13:35:46.000+08:00
* 针对 WebExtensions API Changes (Firefox 149-152) 做修正

* 🔒 调整 MV2 内容安全策略

---------

Co-authored-by: 王一之 &lt;yz@ggnb.top&gt;
diff --git a/build/assets/template/background.html b/build/assets/template/background.html
@@ -2,13 +2,17 @@
 <html>
   <head>
     <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Background</title>
   </head>
   <body>
     <iframe
       src="/src/sandbox.html"
       name="sandbox"
-      sandbox="allow-scripts"
-      style="display: none"
+      sandbox="allow-same-origin allow-scripts"
+      hidden
+      aria-hidden="true"
+      tabindex="-1"
     ></iframe>
   </body>
 </html>
diff --git a/build/assets/template/options.html b/build/assets/template/options.html
@@ -10,8 +10,10 @@
     <iframe
       src="/src/sandbox.html"
       name="sandbox"
-      sandbox="allow-scripts"
-      style="display: none"
+      sandbox="allow-same-origin allow-scripts"
+      hidden
+      aria-hidden="true"
+      tabindex="-1"
     ></iframe>
   </body>
   <style>
diff --git a/build/assets/template/sandbox.html b/build/assets/template/sandbox.html
@@ -2,18 +2,8 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <script>
-      // 某些版本浏览器会因为sandbox中引用了dexie执行此方法导致报错,这里mock一个假的
-      window.BroadcastChannel = function () {
-        return {
-          postMessage: function () {},
-          close: function () {},
-        };
-      };
-    </script>
-    <title>Document</title>
+    <title>Sandbox</title>
   </head>
   <body></body>
 </html>
diff --git a/build/pack.js b/build/pack.js
@@ -75,8 +75,8 @@ const chromeManifest = { ...manifest };
 delete chromeManifest.content_security_policy;
 
 delete firefoxManifest.sandbox;
-// firefoxManifest.content_security_policy 是为了支持动态组合的 ts.worker.js Blob URL
-firefoxManifest.content_security_policy = "script-src 'self' blob:; object-src 'self' blob:";
+// 配置 Firefox 的 CSP，以支持在 sandbox 中动态执行 background script 代码
+firefoxManifest.content_security_policy = "script-src 'self' blob: 'unsafe-eval'; object-src 'self' blob:";
 firefoxManifest.browser_specific_settings = {
   gecko: {
     id: `{${
diff --git a/src/manifest.json b/src/manifest.json
@@ -20,8 +20,12 @@
   },
   "content_scripts": [
     {
-      "matches": ["<all_urls>"],
-      "js": ["src/content.js"],
+      "matches": [
+        "<all_urls>"
+      ],
+      "js": [
+        "src/content.js"
+      ],
       "run_at": "document_start",
       "all_frames": true
     }
@@ -40,6 +44,9 @@
     "webRequestBlocking"
   ],
   "sandbox": {
-    "pages": ["src/sandbox.html"]
-  }
+    "pages": [
+      "src/sandbox.html"
+    ]
+  },
+  "content_security_policy": "script-src 'self' blob: 'unsafe-eval'; object-src 'self' blob:"
 }
