Chrome Web Store Team complains a Violation: My Extension (Cancelly.ca) is injecting the enterprise.js externally from the Google API in the src/index.js file.

[umrashrf]

Operating System

macOS Ventura 13.5

Browser Version

116.0.5845.179 (Official Build) (arm64)

Firebase SDK Version

^10.1.0

Firebase SDK Product:

Auth

Describe your project's tooling

I am using this https://github.com/JohnBra/vite-web-extension

Describe the problem

Following code after the build generates minified files containing URLs with enterprise.js so the Chrome Web Store Team complains of a violation.

import firebaseConfig from './firebase_config';
import { initializeApp } from 'firebase/app';
import { getAuth, signInWithCustomToken, signOut } from 'firebase/auth';

const app = initializeApp(firebaseConfig);
const auth = getAuth(app);

Steps and code to reproduce issue

Defined in the problem.

[NhienLam]

Hi @umrashrf, the enterprise.js is for reCAPTCHA enterprise. The script will only load if you use reCAPTCHA enterprise. Can you give more information about the violation?

We also have reCAPTCHA v2 script in

firebase-js-sdk/packages/auth/src/platform_browser/recaptcha/recaptcha_loader.ts

Line 33 in 98cfcbd

const RECAPTCHA_BASE = 'https://www.google.com/recaptcha/api.js?';

, does this cause an issue too?

They have been there for a long time already.

[meetyan]

@NhienLam

I have a similar complaint from Google saying that my extension violates the program policy.

Violation reference ID: Blue Argon

Violation: Including remotely hosted code in a Manifest V3 item.

After some investigation, it seems that there's a _loadJS function that creates a script tag and loads code from a remote URL.

https://github.com/firebase/firebase-js-sdk/blob/98cfcbd0c0629d4aee60f686edc0da3e27ce36c6/packages/auth/src/platform_browser/load_js.ts#L25C1-L40C2

Then in gapi.ts, the function is called to load from an external API (which is the Google API).

https://github.com/firebase/firebase-js-sdk/blob/98cfcbd0c0629d4aee60f686edc0da3e27ce36c6/packages/auth/src/platform_browser/iframe/gapi.ts#L89C1-L108C32

Could you please have a look and help us do something to solve the issue?

Thank you.

[carl-jin]

I also received a rejection notification today. Several of my extensions rely on Firebase's auth, and now they can't be updated.

[hsubox76]

I think this is related to the push to Manifest V3 which will be required of all Chrome web store apps as of Jan 2024. Specifically this prohibition against remotely hosted files: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#remotely-hosted-code

[meetyan]

The Chrome Web Store team has officially confirmed that the error is caused by the _loadJS function responsible for loading the Google API.

Here's what they say:

We would like to let you know that under static/js/background.js and static/js/content-script.js files there is an external js file (https://apis.google.com/js/api.js?onload=${t}) that was injected which is against our Chrome Web Store policies.

Please remove the external code file(js file) or else include that external js file in the extension’s code package and re-submit your extension for a review. Your submission will be approved if we find it to be compliant with all our policies.

Looks like something has to change to solve this issue.

[umrashrf]

I will add, it looks like that enterprise.js is needed for reCaptcha as part of the signInWithPhoneNumber function. In my app, I am not using that function or that way of signing in at all. The problem is that all sign-in functions are in the same file/class in the firebase sdk.