From d21ebf7b96c90943ab48ffcd6d5b02c6f7438c04 Mon Sep 17 00:00:00 2001 From: Tianren Dong Date: Sun, 31 May 2026 14:19:04 -0400 Subject: 0.15.29: CSP bypass via CDP Runtime.evaluate for evaluate/snapshot/waitFor/initScript - evaluateInTab/executeInTab now run through CDP Runtime.evaluate instead of new Function() in MAIN world, so chrome_evaluate/chrome_snapshot work on pages that block unsafe-eval (github.com, many bank/SaaS apps). Preserves value markers (undefined/function/symbol/bigint/Error), DOMRect expansion, and the expression/statement fallback; keeps {ok,value} error envelope. - page.waitFor polls via service-worker-side CDP evaluation. - chrome_navigate initScript uses Page.addScriptToEvaluateOnNewDocument. - Add npm test (test-suite/unit/csp-eval.test.mjs) and in-browser regression challenge 42 strict-csp-evaluate; update challenge 39 notes + docs/primer. --- docs/FAQ.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/FAQ.md') diff --git a/docs/FAQ.md b/docs/FAQ.md index f821da7..3893575 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -55,7 +55,7 @@ pi-chrome controls web pages through Chrome extension APIs, page inspection, scr ## Does `chrome_evaluate` work on strict-CSP pages? -Not always. `chrome_evaluate` and `chrome_snapshot` run in the page's MAIN world through the Function constructor, so pages whose CSP blocks `'unsafe-eval'` can reject them. `chrome_screenshot`, `chrome_navigate`, tab tools, and real Chrome input still work because they use extension/browser APIs rather than page JavaScript. +Yes. `chrome_evaluate` and `chrome_snapshot` run in the page's MAIN world through CDP `Runtime.evaluate`, which is a DevTools protocol command and is **not** subject to the page's Content-Security-Policy. They work even on pages that block `'unsafe-eval'` (e.g. github.com and many bank/SaaS apps). `chrome_navigate`'s `initScript` injects at document_start via CDP and likewise bypasses CSP. `chrome_screenshot`, tab tools, and real Chrome input also keep working under any CSP. ## How do I tell whether a click or type worked? -- cgit v1.2.3