fix: use default CSP

scripts/webpack.conf.js

@@ -74,6 +74,7 @@ targets.push(Object.assign({}, base, {
     // split vendor js into its own file
     new webpack.optimize.CommonsChunkPlugin({
       name: 'vendor',
+      minChunks: 2,
     }),
     new HtmlWebpackPlugin({
       filename: 'background/index.html',

src/injected.js

@@ -691,7 +691,7 @@
       AddStyle(css) {
         if (document.head) {
           const style = document.createElement('style');
-          style.innerHTML = css;
+          style.textContent = css;
           document.head.appendChild(style);
         }
       },
@@ -784,7 +784,7 @@
   function inject(code) {
     const script = document.createElement('script');
     const doc = document.body || document.documentElement;
-    script.innerHTML = code;
+    script.textContent = code;
     doc.appendChild(script);
     try {
       doc.removeChild(script);

src/manifest.json

@@ -42,6 +42,5 @@
     "webRequest",
     "webRequestBlocking",
     "notifications"
-  ],
-  "content_security_policy": "script-src 'self'; object-src 'self'"
+  ]
 }