ghostmap/manifest.json at main · uppifyagency/ghostmap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
{
  "manifest_version": 3,
  "name": "Ghost Map Pro",
  "version": "9.12.13",
  "description": "Extract business leads from Google Business Profiles with smart email discovery and export.",
  "icons": {
    "16": "icons/icon-16.png",
    "48": "icons/icon-48.png",
    "128": "icons/icon-128.png"
  },
  "permissions": [
    "activeTab",
    "scripting",
    "storage",
    "offscreen",
    "sidePanel",
    "tabs",
    "alarms"
  ],
  "host_permissions": [
    "https://www.google.com/maps/*",
    "https://*/*"
  ],
  "background": {
    "service_worker": "background/sw.js",
    "type": "module"
  },
  "action": {
    "default_title": "Open Ghost Map",
    "default_icon": {
      "16": "icons/icon-16.png",
      "48": "icons/icon-48.png",
      "128": "icons/icon-128.png"
    }
  },
  "side_panel": {
    "default_path": "ui/sidepanel.html"
  },
  "content_scripts": [
    {
      "matches": [
        "https://www.google.com/maps/*"
      ],
      "js": [
        "content/gmb/loader.js"
      ],
      "run_at": "document_idle"
    },
    {
      "matches": [
        "https://www.google.com/maps/*"
      ],
      "js": [
        "content/gmb/maps-state-watcher.js",
        "content/gmb/detail-fetcher.js"
      ],
      "world": "MAIN",
      "run_at": "document_start"
    }
  ],
  "web_accessible_resources": [
    {
      "_comment_co_8": "CO-8 FIX (2026-05-10): content/gmb/*.js and lib/*.js are the watcher scripts injected by observer.js's R-STATE FALLBACK path. Pre-fix they were exposed to <all_urls>, which meant ANY website could <script src='chrome-extension://[EXTENSION_ID]/content/gmb/maps-state-watcher.js'> and (a) execute the watcher in its own page context, (b) use script.onload as a binary oracle to fingerprint extension users + leak the EXTENSION_ID. Now restricted to Google Maps origins, the only legitimate consumer. The fallback path in observer.js:295 still works because it injects only into Maps pages.",
      "_comment_war_01": "WAR-01 FIX (2026-06-09): the dead `assets/*` on <all_urls> block was removed — the assets/ directory does not exist (verified), so it was dead config and a future foot-gun. The `*.js` globs are deliberately NOT narrowed to an explicit file list: content/gmb/loader.js does `import(chrome.runtime.getURL('content/gmb/index.js'))`, so the ENTIRE transitive ES-module graph reachable from index.js (observer.js → lib/config, lib/utils, lib/SelectorEngine, lib/sanitize, lib/phone-normalizer, …) must stay web-accessible or the content script 404s and dies on Maps. Narrowing to a fixed enumeration requires a Chrome-runtime-verified module-graph trace (load unpacked, exercise primary + R-STATE fallback, confirm no chrome-extension:// 404s); deferred to avoid a silent extension-wide break for an exposure already origin-restricted to Google.",
      "resources": [
        "content/gmb/*.js",
        "lib/*.js"
      ],
      "matches": [
        "https://www.google.com/*",
        "https://maps.google.com/*",
        "https://www.google.it/*",
        "https://maps.google.it/*",
        "https://www.google.de/*",
        "https://www.google.fr/*",
        "https://www.google.es/*",
        "https://www.google.co.uk/*"
      ]
    }
  ]
}