Question: Can be my extension allowed to interact with chatterino?

[MiguVT]

Checklist

• I'm reporting a problem with Chatterino
• I've verified that I'm running the most recent nightly build or stable release
• I've looked for my problem on the wiki
• I've searched the issues and pull requests for similar looking reports

Describe your issue

I made this new extension, at the moment im using the key from original extension, but i want to publish it on chrome web store (obv giving credits to this awesome project)
My extension: https://github.com/MiguVT/ChatterinoWatch
Why not the official one? I wanted to make something lighter, more simple and better for only report the watching channel.

Screenshots

No response

OS and Chatterino Version

All

[Nerixyz]

The official extension also has a mode where it doesn't replace Twitch chat (i.e. it only reports the channel).

For your extension to be supported, you'd need a fixed extension ID (your extension would need to be listed on the store).
Maybe there could be a (hidden) setting where you can specify custom extension IDs? The attack surface isn't that large, but I don't think we should statically add another extension ID there, but rather allow users to add their own ID in settings.json under the assumption that they know what they're doing.

[MiguVT]

I didn't think there would be any attack points on something so simple, if that's the case, the option of being able to put a custom ID extension seems like a good idea. Also, the extension is open source so there shouldn't be any attack vectors, even so (in the case that I was a malicious user) I could upload a modified extension to the Google store. Doesn't Google have some kind of protection against this type of attacks? If not, i think the best option is to add a setting with a warning before enabling it.

[Mm2PL]

Why hide that? Just place a textbox for additional extension IDs in the External Tools section. The only things the extension code can do is: 1. Create a new AttachedWindow attached to some window. There would still be a need to know its window id 2. Maybe delete an AttachedWindow if they have an id. W dniu 19.02.2025 o 22:51, nerix pisze:

…

Nerixyz left a comment (Chatterino/chatterino2#5964) The official extension also has a mode where it doesn't replace Twitch chat (i.e. it only reports the channel). For your extension to be supported, you'd need a fixed extension ID (your extension would need to be listed on the store). Maybe there could be a (hidden) setting where you can specify custom extension IDs? The attack surface isn't that large, but I don't think we should statically add another extension ID there, but rather allow users to add their own ID in `settings.json` under the assumption that they know what they're doing.

[MiguVT]

ok, so if im not wrong, there is no problem to make a public supported extensions and allow it by default for easy compatibility with them.

[Nerixyz]

Why hide that? Just place a textbox for additional extension IDs

I wouldn't mind that.

in the External Tools section.

The settings are currently under "General > Browser Integration". Maybe they should be moved to external tools.

ok, so if im not wrong, there is no problem to make a public supported extensions and allow it by default for easy compatibility with them.

My main concern is having this added by default. As stated above, I'm fine with a textbox where you can add additional IDs. (I'm not a maintainer)

[pajlada]

all of what Nerixyz said sounds good to me - would you be open to making the PR itself @MiguVT ?

[MiguVT]

I usually dont use cpp, but i can try make a PR in the next weeks (I dont have too much time because my birthday), next week I will be able to do it.

[pajlada]

Sounds good, let us know if you run into any issues.
To summarize, this should be a setting that allows you to input additional extension IDs that are allowed to make changes to your Chatterino instances.
It's fine for the setting to be a regular string input, with extra extension IDs being split on a character like ; (or whichever other character is not used in extension IDs).
By default, this setting should be empty (i.e. only allowing the official Chatterino extension ID)