Google Chrome displaying an error message on the Zotero Connector

ckharwood

Error report ID 1179431345
Google Chrome version 153.0.8010.53 (Official Build) (64-bit) (cohort: Stable)
Zotero Connector 5.0.215

Google Chrome displayed an error notification for the Zotero Connector extension that led to a list of extension actions that Chrome has blocked. I do not see any new problems with how the extension behaves. Searching did not bring up any pages that reference these error messages. This seemed the best way to bring them to your attention, either to fix or to respond to so there is a record for anyone else who comes across the same error message.

TO REPRODUCE THE ISSUE
I do not know how to ensure that Chrome produces an error notification or list of blocked actions. If the list does exist, you should be able to reach it this way:

1. Open the extension manager in Chrome at chrome://extensions
2. Check the Zotero Connector for an "Error" button in red text. If you see one, click it.
3. This should bring you to the error list, which for me was at the internal URL chrome://extensions/?errors=ekhagklcjbdpajgpjgmbionohlpdbjgc

ON THE ERROR LIST
Each list item has a message, a button to expand the item and display more details, and a button to delete or clear the list item. (I think this is a list and not a log because there are no timestamps.)

Each error message for Zotero Connector followed the same format:

```
Applying inline style violates the following Content Security Policy directive 'default-src 'none''. Either the 'unsafe-inline' keyword, a hash ('sha256-[THE HASH APPEARS TO BE DIFFERENT FOR EACH ITEM]'), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback. The action has been blocked.
```

I checked the details for twenty or so list items; these were all identical. There appears to be a problem in line 120 of offscreen/offscreenTranslate.js on the page offscreen/offscreen.html.

The code comments before line 120 appear to provide some context, so I am including lines 112–120 here:

```
// In a JS environment (the only one where Connector would work), contents
// are treated as a literally string, but in a non-js environment (DOMParser), the contents
// are treated as HTML.
// We're generally not interested in content of tags, but they can sometimes
// cause issues, especially if they do weird things like put tags inside them
// and inside the element, which causes DOMParser to close the tag early
html = html.replace(/]*)?(?:\/>|>.*?<\/noscript>)/gis, '');

let doc = new DOMParser().parseFromString(html, 'text/html');
```

That is all I can discern without digging deeper than I have time for today.

ckharwood

My post was cut off because the forum disallows html tags. To be fair, that is a good decision. I removed the open and closing <>'s below in order to provide the remainder of my post.
-----------------------------------------------------

I checked the details for twenty or so list items; these were all identical. There appears to be a problem in line 120 of offscreen/offscreenTranslate.js on the page offscreen/offscreen.html.

The code comments before line 120 appear to provide some context, so I am including lines 112–120 here:

```
// In a JS environment (the only one where Connector would work), noscript contents
// are treated as a literally string, but in a non-js environment (DOMParser), the contents
// are treated as HTML.
// We're generally not interested in content of noscript tags, but they can sometimes
// cause issues, especially if they do weird things like put img tags inside them
// and inside the element, which causes DOMParser to close the tag early
html = html.replace(/]*)?(?:\/>|>.*?<\/noscript>)/gis, '');

let doc = new DOMParser().parseFromString(html, 'text/html');
```

That is all I can discern without digging deeper than I have time for today.