部署Google Chrome扩展程序; Adobe Flash Player已经停止了潜在的不安全操作 [英] Deploying a Google Chrome extension; Adobe Flash Player has stopped a potentially unsafe operation

问题描述

我想知道如何最好地处理Google Chrome扩展程序中没有足够权限的问题。我正在与YouTube API进行交互，但是我没有使用swfobject.js，只是使用embdeeded div。我不相信这是引发我的安全问题，但也许是这样。

在开发中，我不得不导航到Adobe的Flash播放器安全页面，并指定我的开发文件夹为一个安全的位置。在部署中，我没有这个能力。我不希望我的用户不得不点击Flash Player安全性上的全部允许，但是我没有看到另一种方法来实现我的结果。

有没有人有经验处理这个？我的选择是什么？

似乎是，但是仍然没有答案。

来源： https://github.com/MeoMix/YouPod

运行：从点击扳手，进入扩展，检查开发工具 - >加载解压后的扩展，并浏览到该文件夹​​。

在行动：< a href =http://www.meomixes.com/Chrome%20Extension.crx =nofollow noreferrer> http://www.meomixes.com/Chrome%20Extension.crx

解决方案

由于原始限制，您不能使用< object> 元素。请嵌入< iframe> ，并使用YouTube播放器API与框架进行通信。 函数onYouTubePlayerReady 和函数初始化（播放列表）与以下（在

  >  function Initialize（playlist）{
 port = chrome.extension.connect（{name：statusPoller}）; 
 if（！player）{
 YT_ready（function（）{
 var frameID = getFrameID（MusicHolder）; 
 if（frameID）{
 player = new YT.Player（frameID，{
 events：{
onReady：function（）{
 player.cueVideoById（playlist [0] .ID，0）; 
}， 
onStateChange：onPlayerStateChange 
} 
}）; 
} 
}）; 
} else {
 //只有在玩家不玩的情况下才能重新加载。否则，当重新打开弹出窗口时，音乐
 //停止。 
 if（player.getPlayerState&& player.getPlayerState（）！= PLAYING）{
 player.cueVideoById（playlist [0] .ID，0）; 
 
 
 
 
 
 
为了得到前面的代码您必须在  background.htm  。   youtube-player-api-helper.js  是基于我以前的答案 听Youtube JavaScript或jQuery中的事件 ： 
 
 
  // @description更简单的方法来实现YouTube JavaScript API 
 // @author Rob W 
 // @global getFrameID（id）快速查找与给定ID相对应的iframe对象。 
 // @global YT_ready（Function：function [，Boolean：qeue_at_start]）
 // @global onYouTubePlayerAPIReady（） - 用于触发qeued函数
 // @website https：// stackoverflow.com/a/7988536/938089?listening-for-youtube-event-in-javascript-or-jquery 
 
函数getFrameID（id）{
 var elem = document.getElementById（ ID）; 
 if（elem）{
 if（/ ^ iframe $ / i.test（elem.tagName））return id; // Frame，OK 
 // else：寻找框架
 var elems = elem.getElementsByTagName（iframe）; 
 if（！elems.length）返回null; // iframe找不到，失败
 for（var i = 0; i< elems.length; i ++）{
 if（/ ^ https？：\ / \ /（?: www\ 。）？youtube（？： -  nocookie）？\.com（\ / | $）/ i.test（elems [i] .src））break; 
} 
 elem = elems [i]; //唯一或最好的iframe 
 if（elem.id）return elem.id; //现有的ID，返回
 // else：创建一个新的ID 
 do {//保留后缀`-frame`直到ID是唯一的
 id + =-frame; 
} while（document.getElementById（id））; 
 elem.id = id; 
 return id; 
} 
 //如果没有元素，则返回null。 
返回null; 
} 
 
 //定义YT_ready函数。 
 var yT_ready =（function（）{
 var onReady_funcs = []，api_isReady = false; 
 / * @param func函数执行准备好的函数
 * @param func Boolean如果为true，所有的执行函数都被执行
 * @param b_before布尔值如果为true，func将被添加到队列中的第一个
位置* / 
 return function（func，b_before）{
 if（func === true）{
 api_isReady = true; 
 for（var i = 0; i< onReady_funcs.length; i ++）{
 //删除第一个func从数组中执行func 
 onReady_funcs.shift（）（）; 
} 
} 
 else if（typeof func ==function）{
 if （func）; 
} 
} 
}）（）; 
 //当API被完全加载时，这个函数将被调用
函数onYouTubePlayerAPIReady（）{YT_ready（true）;} 
 
 //加载YouTube框架API 
 （function（）{// Closure，不泄漏到作用域
 var s = document.createElement（script）; 
 s.src =http://www.youtube.com/ player_api; / *加载播放器API * / 
 var before = document.getElementsByTagName（script）[0]; 
.parerentNode.insertBefore（s，before）; 
}） （）; 
  
额外变更的解释（奖金）：
 
 
 
 
   background.htm  ：<！DOCTYPE html /> code>无效。它应该是：<！DOCTYPE html> 。
 
 
   .htm  files ：在< script> 标记中，类型属性是可选的。即使你想指定一个，使用 application / javascript 而不是 text / javascript 。这两种方式都可以在Chrome扩展程序中使用，但第一种方式更为准确。       popup.js   ：更改了 ctrl  +  c 的检测。使用 e.ctrlKey 属性而不是检测并记住 Ctrl 是否被按下。
 
 
还有一些。查看  popup.js  ，然后搜索 RobW：找到我的注释。
 
 
 
 
 
修改过的文件
 
 
 
更新文件摘要（根据您的 Github回购）：
 
 
 
 
 
   YouPod / background.htm   
 
 
   YouPod / popup.htm   （Doctype修正，针对占位符注释的建议） 
 
 
   YouPod / js / background.js   
 
 
   YouPod / js / popup.js   
 
 
   YouPad / js / youtube-player-api-helper.js    新  
 
 
 
I am wondering how to best handle the issue of not having enough permission inside of a Google Chrome Extension. I am interacting with the YouTube API, but I am not using swfobject.js, just using am embdeeded div. I do not believe this is introducing my security issue, but perhaps it is.

In development, I had to navigate to Adobe's flash player security page and designate my development folder as a 'safe' location. In deployment, I do not have the ability to do this. I do not want my users to have to click 'Allow All' on flash player security, but I do not see another way to achieve my results.

Does anyone have any experience dealing with this? What are my options?

Seems to be a duplicate of SWFobject in a Chrome Extension - API Unavaiable but remains unanswered.

Source: https://github.com/MeoMix/YouPod

To run: Pull from the repo, load up Chrome, click the wrench, go to extension, check 'Developer Tools' -> Load Unpacked Extension and browse to the folder.

In action: http://www.meomixes.com/Chrome%20Extension.crx
解决方案
Because of the origin restrictions, you cannot use an <object> element. Instead, embed an <iframe> and use the YouTube player API to communicate with the frame.

Replace your function onYouTubePlayerReady and function Initialize(playlist) with the following (in background.js):
function Initialize(playlist) {
    port = chrome.extension.connect({ name: "statusPoller" });
    if (!player) {
        YT_ready(function() {
            var frameID = getFrameID("MusicHolder");
            if (frameID) {
                player = new YT.Player(frameID, {
                    events: {
                        "onReady": function() {
                            player.cueVideoById(playlist[0].ID, 0);
                        },
                        "onStateChange": onPlayerStateChange
                    }
                });
            }
        });
    } else {
        // Only reload if the player is not playing. Otherwise, the music
        // stops when re-opening the popup.
        if (player.getPlayerState && player.getPlayerState() != PLAYING) {
            player.cueVideoById(playlist[0].ID, 0);
        }
    }
}
To get the previous code to work, you have to load another script in background.htm. The contents of youtube-player-api-helper.js are based on my previous answer to Listening for Youtube Event in JavaScript or jQuery:
// @description Easier way to implement the YouTube JavaScript API
// @author      Rob W
// @global      getFrameID(id) Quick way to find the iframe object which corresponds to the given ID.
// @global      YT_ready(Function:function [, Boolean:qeue_at_start])
// @global      onYouTubePlayerAPIReady()  - Used to trigger the qeued functions
// @website     https://stackoverflow.com/a/7988536/938089?listening-for-youtube-event-in-javascript-or-jquery

function getFrameID(id) {
    var elem = document.getElementById(id);
    if (elem) {
        if(/^iframe$/i.test(elem.tagName)) return id; //Frame, OK
        // else: Look for frame
        var elems = elem.getElementsByTagName("iframe");
        if (!elems.length) return null; //No iframe found, FAILURE
        for (var i=0; i<elems.length; i++) {
           if (/^https?:\/\/(?:www\.)?youtube(?:-nocookie)?\.com(\/|$)/i.test(elems[i].src)) break;
        }
        elem = elems[i]; //The only, or the best iFrame
        if (elem.id) return elem.id; //Existing ID, return it
        // else: Create a new ID
        do { //Keep postfixing `-frame` until the ID is unique
            id += "-frame";
        } while (document.getElementById(id));
        elem.id = id;
        return id;
    }
    // If no element, return null.
    return null;
}

// Define YT_ready function.
var YT_ready = (function() {
    var onReady_funcs = [], api_isReady = false;
    /* @param func function     Function to execute on ready
     * @param func Boolean      If true, all qeued functions are executed
     * @param b_before Boolean  If true, the func will added to the first
                                 position in the queue*/
    return function(func, b_before) {
        if (func === true) {
            api_isReady = true;
            for (var i=0; i<onReady_funcs.length; i++){
                // Removes the first func from the array, and execute func
                onReady_funcs.shift()();
            }
        }
        else if(typeof func == "function") {
            if (api_isReady) func();
            else onReady_funcs[b_before?"unshift":"push"](func); 
        }
    }
})();
// This function will be called when the API is fully loaded
function onYouTubePlayerAPIReady() {YT_ready(true);}

// Load YouTube Frame API
(function() { //Closure, to not leak to the scope
  var s = document.createElement("script");
  s.src = "http://www.youtube.com/player_api"; /* Load Player API*/
  var before = document.getElementsByTagName("script")[0];
  before.parentNode.insertBefore(s, before);
})();
Explanation of the additional changes (bonus):


background.htm: <!DOCTYPE html /> is invalid. It should be: <!DOCTYPE html>.
All .htm files: The type attribute is optional on the <script> tag. Even if you want to specify one, use application/javascript instead of text/javascript. Both will work in a Chrome extension, but the first one is more correct.
popup.js: Changed detection of ctrl+c. Instead of detecting and remembering whether Ctrl was pressed, use the e.ctrlKey property.
And some more. Have a look at popup.js, and search for RobW: to find my annotations.


Modfied files

Summary of updated files (based on your Github repo):


YouPod/background.htm
YouPod/popup.htm (Doctype fix, commented suggestion for placeholder focus)
YouPod/js/background.js
YouPod/js/popup.js
YouPad/js/youtube-player-api-helper.js New


                        
这篇关于部署Google Chrome扩展程序; Adobe Flash Player已经停止了潜在的不安全操作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！