I’m building a chrome extension to change the favicon of the newly opened tabs to differentiate them (to know that I did not read them yet), it works generally well except when CSP is applied. but a strange thing is happening:
I open for example a site using a strict CSP like: https://developer.mozilla.org/en-US/docs/Learn/HTML
I use this code to load and image in the page and as favicon
let FAVICON_URLl = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAABQZJREFUaEPtmX0sXXcYx7+mJFI0wRLXmqDJvNz1ermk1jD1siij5i3ewtxis1l0hEZL2mjKmKtdbTo6zChTwzRVw4pttJZ6f2u5ltQqXbououvKtAzL73fiTu927z2J3LPI7vPPPfee53ee3+f3POec7/O7GuvAOraxaagB/uPsaTxvZLK9S0gNoC6hra2A+h7Y2vptffT/OwO6uroQOthLl/Hpk6fQ0tpBv4+MjGFhYUHuEltYvAhjnjE9v7K8Ak3N5+jx48cLGB0dY52aLWUgKioSZz8U02CLi4uQSKYhFDJAB718MTw8IncinV3tEAj20vNNTZcRGBhAj8kYMpatbQmguqYSXl6v0ljNzS0w4fHg4ChUCrB79wsYHLoJDQ0N6ns0LR3igg+4BdDR0cGUZBzkk1hi4hHExYpYAcTHx+L93NN03KNHvyMsNAJt7S3cAvj6vYaKilIadHV1FXy+Lb6oqWIF0NhYh1dcXejYhvpGlJSUoqOzjVuAoqJChIaF0KA9PTcQHBSK1tZmpQC7dunj9uS49GaPi30Ld+/OcgugqamJW7dHYGBgQAEyM06itLScFUBISBA+Kf6YjlteXoaVpQB79phzC+DsvB9NlxukDwpHh/2YnZ1lBVBWfgH+/n50bEdHFyIjomFjI+AW4HR2FhIS3qSTmJi4BQ93L3qsrIS0tbUxOTUGPT096p+Wmo6qqmruAfoHemFqakonIRafhTj/DCsAT08P1F66SH3X1tZga+OABw9+5RaAz7fGd993SMvH0+MgxscnWAGIC/IQExNNfQcHhuDjc4gec1pCqanJSD92lAa+d+9nOAidsL7ONHWKSoi8tIZH+mFiwqO+2dm5+KiwiHuAax2tsLW1oYHLyj5DxvET0mwoAiCaqa3tqtTXxdkN09M/cgvA4xljZHRAKgGCg8PQ032dFUBm5jG8l5xEfWdmfoLTPmfpOM5KKDZOhLy8HBqYSAC+tQArK3+yAui5/i0sLS2o7/miYpw6lc09QH19LQ64udLADQ1fIfEdZkU3TF4JmZub4WbfDamfn28A+vr6uQXQ19ejEkBbW4sGjo9LwJUrf9e0ops48d23kZXF3Ctzc3MQ7BVS/bRhnJRQUFAASi6cpzE3JIBswyIvA81Xm+DktI+OrampRUpy2jOZ4wTg09JiBAT408CdnV2ICGee58pKyMjICOMTQyD6iVh0lAjt7de4BSBtIikfoiSJkQaksrKaFUBkZDjOFTJv6qWlJSreyOdmU3kG3N3dUPdlDY1JXlp2to64f/8XVgBVFyvg7c1opa9bWiESxf9jnMoB8vNzITr8Bg08NDgMb29GTSoroakpyTNdW1JSMuou1XMLICsBcnLyUHiO0fPKAMiuQ2VlOXUjT52X+HaYn5/nFsDe3g7t3zD9KrHNEkAZwOHYGISHh1K33t4fEPA608HJmkpL6HhGOlJSjtCYshJAEYCP9yFU13wOQ0ND6nbyRBbtfTkH6O7uhJW1FY0rKwEUAZBmpeAMs1VC7GUnF9y5M8MtgJmZKfr6e6VBZSWAIoDGxiYEBwdSl8nJKRxw9fzXyZMfVVZC5LlvZmYmDUzax80SQHZGRKzt1N1Jf35Cthl3MNuMDx/+RntmeUb2lqz5TJYXF/+AZEoi11f2xJZ25lhHUaGjGkCFi8vq0uoMsFomFTqpM6DCxWV1afIPw/b+p14NwCrRqnP6CxZh0hrAol2VAAAAAElFTkSuQmCC';
// test1: load it in page
const imgg1 = document.createElement('img');
imgg1.src = FAVICON_URLl;
imgg1.style.cssText = 'position:absolute;top:0;border:2px solid black;width:80px;height:80px;z-index:99999;';
document.body.appendChild(imgg1);
// test2: load it as a favicon
const linkk = document.createElement('link');
linkk.type = 'image/png';
linkk.rel = 'icon';
linkk.href = FAVICON_URLl;
document.head.appendChild(linkk);
test1 gaves no error and the picture is displayed without any CSP error.
but test2 gaves this CSP error at document.head.appendChild(linkk);
Refused to load the image
‘data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADA…..’ because it
violates the following Content Security Policy directive: “img-src
‘self’ *.githubusercontent.com .googleusercontent.com .gravatar.com
mozillausercontent.com firefoxusercontent.com profile.stage.mozaws.net
profile.accounts.firefox.com mdn.dev
interactive-examples.mdn.mozilla.net
interactive-examples.mdn.allizom.net wikipedia.org
upload.wikimedia.org https://.google-analytics.com
https://.googletagmanager.com www.gstatic.com”.
conclusion:
the image can be used and be displayed on the web page visually when we use it as img.src even if CSP block them, but cannot be used in head link rel tag <link rel="icon" href="...."> if CSP does not allow it.
here they say:
By default, browsers enforce the same-origin policy to prevent a web
page from accessing cross-origin resources. For example, when a
cross-origin image is loaded, even though it’s displayed on the web
page visually, the JavaScript on the page doesn’t have access to the
image’s data. The resource provider can relax restrictions and allow
other websites to read the resource by opting-in with CORS.
https://web.dev/articles/security-headers
But what I do not understand is why in <link rel="icon" href= is not allowed, it is not javascript, and I’m not accessing it with javascript, so the browser should not block it because of CSP, it should be treated like img.src! no?
Why is this happening? I had read all what I could find about CSP but could not find anything that mentions this behavior. If this is expected, please do you have any source about this behavior? or an explanation at least?






