save file

Author: javascript-2020

blog/25-12-04/bypass-csp/bypass-csp.html

@@ -211,7 +211,7 @@
     {font-family:pacifico}
 
   .br
-    {margin-top: 1.5em}
+    {margin-top:1em}
 
             </style>
 
@@ -233,69 +233,62 @@ <h1 class=title style='position:absolute;left:0;right:0;margin:auto;top:-10px'>
 
             <div class=description>
                   <p>
-                        I was in the process of answer this question
-                        <br>
-                        <br>
+                        I was in the process of answer this question<br>
+                        <div class=br></div>
                         <a href='https://stackoverflow.com/questions/79833235/is-it-possible-to-connect-to-a-local-python-server-using-secure-web-sockets-from'>
                               Is it possible to connect to a local Python server using secure web sockets from a browser console on an HTTPS webpage?
                               <span class=link-domain>
                                     stackoverflow.com
                               </span>
-                        </a>
-                        <br>
-                        <br>
+                        </a><br>
+                        <div class=br></div>
                         but i didnt qant to get -1'd for no reason ...
                         <a href='https://stackoverflow.com/questions/28099493/running-ffmpeg-in-browser-options/79820132#79820132'>
                               Running ffmpeg in browser - options?
                               <span class=link-domain>
                                     stackoverflow.com
                               </span>
-                        </a>
-                        <br>
-                        <br>
-                        so i thought i'd write a blog post about it anyway
-                        <br>
-                        <br>
+                        </a><br>
+                        <div class=br></div>
+                        so i thought i'd write a blog post about it anyway<br>
+                        <div class=br></div>
                         Discover how to overcome the content-security-policy for a website.
                   </p>
             </div>
 
 
-            <h3 class=blog-hdr>
+            <h3 class=blog-hdr style='margin-bottom:0'>
                   Manifest v2
             </h3>
 
             <section class=blog-text>
                   so right off the bat, manifest v2 is capable of removing the contest-security-policy on a web request<br>
                   firefox still ( currently, at the time of writing ) supports manifest v2, it has the bindings for manifest v3 but
-                  they are just stubs that do nothing<br>
-                  
-                  <div class=br></div>
-                  
+                  they are just stubs that do nothing<br>                  
+                  <div class=br></div>                  
                   chromium and hence google chrome, edge, brave, opera and any of the myriad of browsers that are based on chromium do
                   not support manifest v2<br>
-                  <br>
+                  <div class=br></div>
                   google's official stance on manifest v3 changes<br>
-                  <br>
+                  <div class=br></div>
                   To prevent extensions from weakening site security. Allowing CSP removal would undermine protections against XSS and remote code injection.<br>
-                  <br>
+                  <div class=br></div>
                   <a href='https://developer.chrome.com/docs/extensions/migrating/improve-security/'>
                         Improve extension security
                         <span class=link-domain>
                               developer.chrome.com
                         </span>
                   </a>
-                  <br>
+                  <div class=br></div>
                   for those who wish to develop using the old manifest v2, previous versions of chromium can be downloaded from<br>
                   <a href='https://www.chromium.org/getting-involved/download-chromium/#downloading-old-builds-of-chrome-chromium'>
                         Downloading old builds of Chrome / Chromium
                         <span class=link-domain>
                               chromium.org
                         </span>
                   </a>
-                  <br>
+                  <div class=br></div>
                   manifest V3 is supported generally in Chrome 88 ( January 19th, 2021 ) or later.<br>
-                  <br>
             </section>