种草星球,TikTok批量建联,达人建联,达人管理,自动提报

This declarativeNetRequest rule matches ALL HTTPS URLs (urlFilter '|https*') — far beyond the extension's declared host_permissions of buyin.jinritemai.com and douyin.com — and overwrites the Content-Security-Policy response header with a single space character, effectively disabling CSP for every website visited in the browser. Stripping CSP globally removes XSS and injection protections from sites that rely on it, a technique used by malicious extensions to enable code injection attacks on banking, email, and other sensitive sites. There is no legitimate justification for an e-commerce operations extension to disable Content Security Policy browser-wide.

[  {    "id": 1,    "priority": 1,    "condition": {      "urlFilter": "|https*",      "resourceTypes": [        "csp_report",        "font",        "image",        "main_frame",        "media",        "object",        "other",        "ping",        "script",        "stylesheet",        "sub_frame",        "webbundle",        "websocket",        "webtransport",        "xmlhttprequest"      ]    },    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "Content-Security-Policy",          "operation": "set",          "value": " "        }      ]    }  }]