For Chrome extension publishing purposes, does using a Bootstrap CDN count as remote code?
I am trying to publish a Google Chrome Extension. Before doing it, there is a form to fill:
I am unsure about how to answer. The extension does use a bootstrap CDN via:
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-GLhlTQ8iRABdZLl6O3oVMWSktQOp6b7In1Zl3/Jr59b6EGGoI1aFkw7cmDA6j6gD" crossorigin="anonymous">
On the side it says:
Remote code is any JS, Wasm, or CSS that is not included in the extension's package. This includes references to external files in tags, modules pointing to external files, and strings evaluated through eval()
Is this CDN use considered as remote code? Is it considered a module pointing to an external file?
Yes, remote code would include CSS files served by a CDN. There are various areas in the Chrome Extensions documentation that specifically define remote code as any code not bundled in your extension. They even include "Any library hosted on a CDN". In fact, they actually specifically reference Bootstrap on the Remotely hosted code restrictions page.
Although CSS is not something blocked by the new Manifest V3 restrictions on remote code, including remote code can make the review process take longer. Instead, it's better to include the library bundled with the extension (assuming the library's license allows it).