使用Chrome Extension Manifest V3，如何执行代码字符串？

Question

I'm writing a Chrome extension using Manifest V3 and trying to find a way to execute code strings dynamically (similar to userscripts). There are methods to execute code strings (eval, setTimeout, new Function, etc.); however, they seem forbidden in Manifest V3. While setTimeout still works, the Chrome team states that executing code strings will no longer be accepted when submitted to the Chrome Web Store. The code needs to be part of the extension when submitted. Also stated in the link below under “Remotely Hosted Code”:

https://developer.chrome.com/docs/extensions/mv3/intro/mv3-migration/

Saw some forum posts and crbugs posted about this issue, but they all seem outdated without a definitive answer. Like the link above, older posts state that it will no longer be possible to execute code strings. Newer but still outdated (2020) posts state that Manifest V3 will have use cases (such as TamperMonkey) where userscripts can be registered dynamically but only after giving the user a prompt. The only two methods I see that let an extension run scripts dynamically are “chrome.scripting.registerContentScripts” and “chrome.scripting.executeScript”. Both methods execute code from files, not strings. The older method “chrome.tabs.executeScript” used to allow executing code strings but is now deprecated.

Is there a way that is allowed by the Chrome Web Store or any update to this issue?

Edit:

If executing scripts dynamically from files is the only way:

1. Do Chrome Extensions allow saving files in the extension directory? Or would it invalidate the extension (the extension is automatically uninstalled because of some security policy)?
2. Can the two current methods (mentioned above) execute files outside of the extension if it saves the files on the user's hard drive?

Thanks.

Answer 1

In sandbox, code string can be executed.

https://developer.chrome.com/docs/extensions/mv3/manifest/sandbox/

There is several restrictions to the sandbox code, for example, it cannot access to DOM. It depends on what you want to do by the code string.