javascript 网站可以阻止 Chrome 扩展程序吗？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/16786186/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Can a website block a Chrome Extension?
提问by sonicboom
Is it possible to block Chrome Extensions from running on particular websites?
是否可以阻止 Chrome 扩展程序在特定网站上运行？
Say I have a website www.foo.com, is it possible for me to block Chrome Extensions (in particular, content scripts) from working on my website, or stop them from accessing the DOM?
假设我有一个网站www.foo.com，我是否可以阻止 Chrome 扩展程序（特别是内容脚本）在我的网站上工作，或者阻止它们访问 DOM？
采纳答案by winner_joiner
For the short Answer to the question goto the 4th Edit:
对于问题的简短回答，请转到第 4 次编辑：
You need to know the extensionId from the Extension you want to block, so that it works.
您需要知道要阻止的 Extension 的 extensionId，以便它可以工作。
Here is a Testsite from the Prove of Concept Testsite
这是来自概念 验证测试站点的测试站点
and here is the information behind the Solution: Intro to Chrome addons hacking: fingerprinting
这是解决方案背后的信息： Chrome插件黑客简介：指纹识别
Now that you know what Extensions are Running you can, redirect/block/...
现在您知道了正在运行的扩展程序，您可以重定向/阻止/...
I hope it helps.
我希望它有帮助。
Edit:
编辑：
Tested with (Chrome Version 27.0.1453.94) on Windows XP
在 Windows XP 上测试（Chrome 版本 27.0.1453.94）
Edit 2:
编辑2：
This technique will only work if:
此技术仅在以下情况下有效：
- You know the extensionid :)
- IMPORTANT!at least one Ressource(like the manifest.json, some image, script, ...) is set as "web_accessible_resources" (in the manifest) OR the extension still uses a manifest version 1 and has no "web_accessible_resources" set. (Ressource from chrome dev site Link)
- 你知道 extensionid :)
- 重要的！至少有一个资源（如 manifest.json、一些图像、脚本...）被设置为“web_accessible_resources”（在清单中）或者扩展仍然使用清单版本 1 并且没有设置“web_accessible_resources”。（资源来自 chrome 开发站点链接）
Edit 3:
编辑3：
Case Extension: JSONView
案例扩展：JSONView
You could detect the extension with this code(only example code):
您可以使用此代码（仅示例代码）检测扩展名：
<script src="chrome-extension://chklaanhfefbnpoihckbnefhakgolnmc/error.gif" onerror="console.info('Extension Not Found')" onload="console.info('Extension Found')"></script>
<!-- since the the file error.gif is allowed in the manifest "web_accessible_resources" (any other file mentioned there would also be fine) -->
<!-- the block code should come in the onload of the script tag -->
<!-- tested with Chrome 27+ WinXp -->
Some Context:The JSONView Extension has a version 2 Manifest:
一些上下文：JSONView 扩展有一个版本 2 清单：
...
"manifest_version": 2,
"name": "JSONView",
...
so by default you cannot access the manifest file as mentioned in the "Prove of Concept" above.
因此默认情况下您无法访问上面“概念证明”中提到的清单文件。
BUTit uses the "web_accessible_resources"attribute in the Manifest, which allows websites to access files from the Extension.
但它使用清单中的“web_accessible_resources”属性，允许网站从扩展访问文件。
...
"web_accessible_resources": [ "jsonview.css", "jsonview-core.css", "content_error.css", "options.png", "close_icon.gif", "error.gif" ]
...
So now you can call any of this files from your webpage.
所以现在您可以从您的网页调用任何这些文件。
example:
例子：
chrome-extension://chklaanhfefbnpoihckbnefhakgolnmc/error.gif
chrome-extension://chklaanhfefbnpoihckbnefhakgolnmc/jsonview.css
...
And with this url in an Image/Script/.. -Tag you can know if the extension is there, if the onload Event fires.
使用 Image/Script/.. -Tag 中的这个 url，您可以知道扩展是否存在，如果 onload 事件触发。
P.s.: i only tested this with Chrome Version 27.0.1453.94) on Windows XP, in other Versions it might not work. (see comment from T.J. Crowder)
Ps：我只在 Windows XP 上用 Chrome 版本 27.0.1453.94) 测试过这个，在其他版本中它可能不起作用。（见 TJ Crowder 的评论）
P.P.s.: For More Details check the Chrome Developer Ressources. Here is the Link to the Extension on the Chrome Ressource Page "Finger printing" Stuff)
PPs：有关更多详细信息，请查看 Chrome 开发人员资源。这是 Chrome 资源页面“指纹”上的扩展程序链接）
Edit 4:
编辑4：
I don't think it can be blocked per se, but if you can detect the extension as mentioned above you could:
我不认为它本身可以被阻止，但是如果您可以检测到上述扩展名，您可以：
- redirect away from your Page
- or Popup a message(every few seconds) saying, "disable the extension for this Site"
- or you could check the Extension code to see if you maybe could "break" or hinder its functionality.
- or you could use some Code like in the answer of BeardFist
- 从您的主页重定向
- 或弹出一条消息（每隔几秒）说“禁用此站点的扩展程序”
- 或者您可以检查扩展代码，看看您是否可能“破坏”或阻碍其功能。
- 或者你可以使用一些代码，比如BeardFist的回答
回答by BeardFist
Since the other answer didn't really answer anything about actually stopping an extension, I thought I would add my own two cents. Using the method in the other answer, you can sometimesdetect if a particular extension is installed and react accordingly, but this requires you to test for a particular ID string and file for that particular extension. I am sure that we can all agree that this isn't a very encompassing solution.
由于另一个答案并没有真正回答有关实际停止延期的任何问题，我想我会自己加两分钱。使用另一个答案中的方法，您有时可以检测是否安装了特定扩展并做出相应反应，但这需要您测试该特定扩展的特定 ID 字符串和文件。我相信我们都同意这不是一个非常全面的解决方案。
There are many things about extensions that you cannot stop from within your site, such as the chrome.webRequestapi that adblock makes use of. There is nothing you can do to interfere directly with that sort of code, but there is plenty you can do on the DOM manipulation side.
有很多关于扩展的东西是你无法停止的，比如chrome.webRequestadblock 使用的api。您无法直接干预此类代码，但在 DOM 操作方面您可以做很多事情。
Content Scriptsoperate in an isolated worldmeaning that they cannot see/interact with the javascript running on the site. They do, however, have complete access to the DOM and can do whatever they want to it. Conversely, your own javascript has the same access to that DOM. Taking advantage of that isolated worldwe can set up a MutationObserverto watch over the DOM and prevent any unwanted changes. Because of the isolated world, content scriptscannot disable or turn off our observer while our own javascript can do so freely.
Content Scripts以一种isolated world他们无法看到/与网站上运行的 javascript 交互的方式运行。但是，他们确实可以完全访问 DOM，并且可以为所欲为。相反，您自己的 javascript 对该 DOM 具有相同的访问权限。利用这一点，isolated world我们可以设置一个MutationObserver来监视 DOM 并防止任何不需要的更改。由于isolated world,content scripts不能禁用或关闭我们的观察者，而我们自己的 javascript 可以自由地这样做。
Here is an example of a MutationObserverthat locks down the DOM with a little jQuerymixed in because I am lazy.
这是一个例子，因为我很懒惰，所以MutationObserver它锁定了 DOM 并jQuery混入了一点。
var config= {childList: true,
attributes: true,
characterData: true,
subtree: true,
attributeOldValue: true,
characterDataOldValue: true};
var observer = new MutationObserver(function(mutations){
mutations.forEach(function(mutation){
switch(mutation.type){
case "attributes":
observer.disconnect();
if(mutation.attributeName == "class")
mutation.target.className = mutation.oldValue;
else if(mutation.attributeName=="id"||mutation.attributeName=="title")
mutation.target[mutation.attributeName] = mutation.oldValue;
else if(mutation.attributeName == "style")
mutation.target.style.cssText = mutation.oldValue;
observer.observe(document,config);
break;
case "characterData":
observer.disconnect();
mutation.target.data = mutation.oldValue;
observer.observe(document,config);
break;
case "childList":
observer.disconnect();
if(mutation.addedNodes.length > 0)
$(mutation.addedNodes[0]).remove();
if(mutation.removedNodes.length > 0){
if(mutation.nextSibling)
$(mutation.removedNodes[0]).insertBefore(mutation.nextSibling);
else if(mutation.previousSibling)
$(mutation.removedNodes[0]).insertAfter(mutation.previousSibling);
else
$(mutation.removedNodes[0]).appendTo(mutation.target);
}
observer.observe(document,config);
break;
}
});
});
$(function(){
observer.observe(document,config);
});
Throwing it into a chrome extension with a simple manifest such as:
将其放入带有简单清单的 chrome 扩展程序中，例如：
{
"name": "DOM Polymerase",
"version": "1.0",
"manifest_version": 2,
"permissions": [
"tabs","<all_urls>"
],
"content_scripts": [{
"matches": ["http://example.iana.org/*"],
"js": ["jquery-1.8.3.min.js","polymerase.js"]
}]
}
And navigating to http://example.iana.org/will show that external manipulation of the DOM (except for some attributes, I didn't code them all in there) is no longer possible. Of course, in this case internal manipulation is also denied, but if the code was in the site instead of an extension, it would be a different story. While this doesn't disable extensions completely, it should at least preserve your DOM.
并且导航到http://example.iana.org/将显示 DOM 的外部操作（除了一些属性，我没有在那里对它们进行编码）不再可能。当然，在这种情况下，内部操作也被拒绝，但如果代码在站点中而不是扩展程序中，那就是另一回事了。虽然这不会完全禁用扩展，但它至少应该保留您的 DOM。
