Browser Extension (Chrome MV3) compatibility: wallet.sync() fails due to CSP restrictions
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 缺陷
- 描述清晰度
- 需要澄清
- 活跃度
- 停滞
- 技术栈
- typescript, wasm
调研方向
首先使用 WebWallet、wallet.sync() 和 initThreadPool(8) 重现 Manifest V3 失败，然后跟踪 worker 和 eval 的使用情况。将其与自定义的 CipherScan sync 和 pczt_create 路径进行比较，以确定是否存在受支持的单线程或数据库兼容路径；完成的标准是存在有文档记录的或可工作的 MV3 兼容事务流程。
由索引模型根据 Issue 内容生成。
描述
Browser Extension (Chrome MV3) Compatibility Issue
🐛 Problem
I'm building a Zcash wallet browser extension using WebZjs, but encountering compatibility issues with Chrome Manifest V3's strict Content Security Policy (CSP).
🔍 Details
Environment:
- Chrome Extension with Manifest V3
@chainsafe/webzjs-wallet(latest version)- Zcash testnet
- CSP:
script-src 'self' 'wasm-unsafe-eval'
Issue:
Chrome MV3 disallows eval() and new Function() for security reasons. This breaks WebZjs's sync mechanism:
// ❌ Fails in Chrome MV3
await wallet.sync();
// Error: eval() is not allowed in Chrome extensions
await initThreadPool(8);
// Error: Web Workers cannot use eval()Root cause:
wallet.sync()spawns Web Workers usingeval()internallyinitThreadPool()also relies oneval()for multi-threading- Chrome MV3 CSP blocks these operations
🔧 Current Workaround
I've implemented a custom sync using CipherScan's WASM for client-side decryption:
// ✅ Works: Custom sync with WASM
const compactBlocks = await fetchCompactBlocks(startHeight, endHeight);
const matches = await batch_filter_compact_outputs(compactBlocks, viewingKey);
const balance = calculateBalance(matches); // 0.02 ZEC ✅However, this creates a critical issue:
// WebZjs's internal database is EMPTY (never synced)
await wallet.propose_transfer(accountId, toAddress, amount);
// ❌ Error: "insufficient balance" (WebZjs DB has no notes!)The problem:
- Custom sync finds funds ✅
- WebZjs DB remains empty ❌
propose_transfer()can't find notes to spend ❌
❓ Questions
Is there a way to:
-
Use WebZjs sync in single-threaded mode (without eval/Web Workers)?
- Does WebZjs have a fallback sync mechanism compatible with MV3?
-
Manually populate WebZjs database with notes from custom sync?
- Can we inject notes/nullifiers into WebZjs's internal DB?
-
Use alternative transaction API (PCZTs?) that doesn't require DB sync?
// Does this work without wallet.sync()?
const pczt = await wallet.pczt_create(accountId, toAddress, value);💡 Why This Matters
Browser extensions are a common use case for crypto wallets (Metamask, Phantom, Rabby, etc.). Chrome MV3 is now mandatory for all new extensions.
Making WebZjs compatible with MV3 would:
- ✅ Enable Zcash browser wallet extensions
- ✅ Improve Zcash ecosystem adoption
- ✅ Align with industry standards (all major wallets support MV3)
📝 Reproduction Steps
- Create Chrome Extension (Manifest V3)
- Add CSP:
"content_security_policy": { "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'" } - Initialize WebZjs:
const wallet = new WebWallet("test", lightwalletdUrl, 10); - Try to sync:
await wallet.sync();→ Fails with CSP error
🙏 Request
Any guidance on MV3-compatible sync or transaction building would be greatly appreciated!
- 主要语言
- TypeScript
- 星标
- 44
- 派生
- 32
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ChainSafe/WebZjs 的其他 Issue
-
难度 5/5 一周以上 新手友好度 20/100
-
难度 4/5 3-5 天 新手友好度 45/100
-
难度 4/5 3-5 天 新手友好度 42/100
-
难度 5/5 一周以上 新手友好度 35/100
-
难度 4/5 3-5 天 新手友好度 25/100
相似的 Issue
-
a10y a10y-audit ai-driven-qa claude
难度 2/5 1-3 小时 新手友好度 86/100
linagora/twake-directory-manager#219 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
type: bug
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 1 天内回复
-
0️⃣ phase/new
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
Pulse v7: buildPreferencesFromTelos() bypasses telosSectionOrFile(), renders empty on unified-TELOS installs可能已有人在做 @zephyr91 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 75/100
danielmiessler/LifeOS#2393 ·
维护者通常 4 天内回复