Merge pull request from GHSA-vh6j-5jqj-7xjw

remove web_accessible_resources

Author: mymindstorm

manifest-chrome.json

@@ -50,9 +50,5 @@
         "https://accounts.google.com/o/oauth2/revoke"
     ],
     "offline_enabled": true,
-    "web_accessible_resources": [
-        "view/qr.html",
-        "images/scan.gif"
-    ],
     "content_security_policy": "script-src 'self'; font-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; connect-src https://www.google.com/ https://*.dropboxapi.com https://www.googleapis.com/ https://accounts.google.com/o/oauth2/revoke ; default-src 'none'"
 }

manifest-firefox.json

@@ -50,9 +50,5 @@
         "https://www.googleapis.com/*",
         "https://accounts.google.com/o/oauth2/revoke"
     ],
-    "web_accessible_resources": [
-        "view/qr.html",
-        "images/scan.gif"
-    ],
     "content_security_policy": "script-src 'self'; font-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; connect-src https://www.google.com/ https://*.dropboxapi.com https://www.googleapis.com/ https://accounts.google.com/o/oauth2/revoke ; default-src 'none'"
 }

package-lock.json

@@ -29,6 +29,7 @@
     "sass": "^1.21.0",
     "ts-loader": "^6.0.2",
     "typescript": "^3.5.1",
+    "url-loader": "^2.0.1",
     "vue-loader": "^15.7.0",
     "vue-svg-loader": "^0.12.0",
     "vue-template-compiler": "^2.6.10",

package.json

@@ -1,3 +1,6 @@
+// @ts-ignore
+import scanGIF from "../images/scan.gif";
+
 if (!document.getElementById("__ga_grayLayout__")) {
   chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     switch (message.action) {
@@ -15,7 +18,7 @@ if (!document.getElementById("__ga_grayLayout__")) {
         alert(message.account + chrome.i18n.getMessage("added"));
         break;
       case "text":
-        showQrCode(message.text);
+        alert(message.text);
         break;
       case "pastecode":
         pasteCode(message.code);
@@ -38,10 +41,7 @@ function showGrayLayout() {
     document.body.appendChild(grayLayout);
     const scan = document.createElement("div");
     scan.className = "scan";
-    scan.style.background =
-      "url(" +
-      chrome.extension.getURL("images/scan.gif") +
-      ") no-repeat center";
+    scan.style.background = `url('${scanGIF}') no-repeat center`;
     grayLayout.appendChild(scan);
     const captureBox = document.createElement("div");
     captureBox.id = "__ga_captureBox__";
@@ -172,21 +172,6 @@ function sendPosition(
   });
 }
 
-function showQrCode(msg: string) {
-  const left = screen.width / 2 - 200;
-  const top = screen.height / 2 - 100;
-  const url =
-    chrome.extension.getURL("view/qr.html") + "?" + encodeURIComponent(msg);
-  window.open(
-    url,
-    "_blank",
-    "toolbar=no, location=no, status=no, menubar=no, scrollbars=yes, copyhistory=no, width=400, height=200, left=" +
-      left +
-      ",top=" +
-      top
-  );
-}
-
 function pasteCode(code: string) {
   const _inputBoxes = document.getElementsByTagName("input");
   const inputBoxes: HTMLInputElement[] = [];

src/content.ts

@@ -10,7 +10,6 @@ module.exports = {
     content: './src/content.ts',
     popup: './src/popup.ts',
     import: './src/import.ts',
-    qr: './src/qr.ts',
     qrdebug: './src/qrdebug.ts',
     test: './src/test/test.ts'
   },
@@ -19,7 +18,7 @@ module.exports = {
       {
         test: /\.tsx?$/,
         loader: 'ts-loader',
-        options: { 
+        options: {
           appendTsSuffixTo: [/\.vue$/],
           transpileOnly: true
         },
@@ -32,6 +31,15 @@ module.exports = {
       {
         test: /\.svg$/,
         loader: 'vue-svg-loader'
+      },
+      {
+        test: /\.(png|jpe?g|gif)$/,
+        use: [
+          {
+            loader: 'url-loader',
+            options: {},
+          }
+        ]
       }
     ]
   },