### Native messaging host manifest file example

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/native-messaging

Example of a native messaging host manifest file. It includes the name, description, path to the host binary, type (stdio), and allowed_origins. The browser reads and validates this file, but does not install or manage it.

```json
{
    "name": "com.my_company.my_app",
    "description": "My App",
    "path": "C:\\Program Files\\My App\\chrome_native_messaging_host.exe",
    "type": "stdio",
    "allowed_origins": [
        "chrome-extension://knldjmfmopnpolahpmmgbagdohdnhkik/"
    ]
}

```

--------------------------------

### Immediate DOM Injection Example

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/csp

A simple example of a content script injecting a script tag that executes immediately.

```javascript
document.write("<script>alert(1);</script>");
```

--------------------------------

### Curl command to publish submission v1.1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

Command line example to publish a submission using ApiKey authentication.

```Console
> curl \
-H "Authorization: ApiKey $ApiKey" \
-H "X-ClientID: $ClientID" \
-X POST \
-d '{ "notes"="text value" }' \
-v \
https://api.addons.microsoftedge.microsoft.com/v1/products/$productID/submissions
```

--------------------------------

### Curl command for v1.1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

Example curl command to check publishing status using ApiKey and X-ClientID.

```Console
> curl \
-H "Authorization: ApiKey $ApiKey" \
-H "X-ClientID: $ClientID" \
-X GET \
-v \
https://api.addons.microsoftedge.microsoft.com/v1/products/$productID/submissions/operations/$operationID
```

--------------------------------

### Example registry keys for native messaging host manifest

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/native-messaging

These are example registry key paths where the native messaging host manifest file location is stored. Microsoft Edge queries HKEY_CURRENT_USER first, then HKEY_LOCAL_MACHINE, and within each, the 32-bit registry before the 64-bit registry.

```text
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.my_company.my_app

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.my_company.my_app

```

--------------------------------

### Curl command to check package upload status v1.1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

Command line example to check package upload status using ApiKey authentication.

```Console
> curl \
-H "Authorization: ApiKey $ApiKey" \
-H "X-ClientID: $ClientID" \
-X GET \
-v \
https://api.addons.microsoftedge.microsoft.com/v1/products/$productID/submissions/draft/package/operations/$operationID
```

--------------------------------

### Curl command to publish submission v1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

Command line example to publish a submission using Bearer token authentication.

```Console
> curl \
-H "Authorization: Bearer $TOKEN" \
-X POST \
-d '{ "notes"="text value" }' \
-v \
https://api.addons.microsoftedge.microsoft.com/v1/products/$productID/submissions
```

--------------------------------

### Curl command for v1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

Example curl command to check publishing status using Bearer token authentication.

```Console
> curl \
-H "Authorization: Bearer $TOKEN" \
-X GET \
-v \
https://api.addons.microsoftedge.microsoft.com/v1/products/$productID/submissions/operations/$operationID
```

--------------------------------

### Initialize popup.js message sender

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/samples/picture-inserter-content-script

Initial setup for the popup.js file to attach an onclick event listener to the Insert picture button.

```javascript
const sendMessageId = document.getElementById("sendmessageid");
if (sendMessageId) {
    sendMessageId.onclick = function() {
        ...
    };
}
```

--------------------------------

### Manifest V3 permissions example with host_permissions

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/declare-permissions

Manifest V3 version of the permissions portion of an extension manifest. Declares tabs, bookmarks, and storage permissions, unlimitedStorage as an optional permission, and host permissions for http://www.blogger.com/ and http://*.google.com/ in the separate host_permissions field.

```json
"permissions": [
  "tabs",
  "bookmarks",
  "storage"
],
"optional_permissions": [
  "unlimitedStorage"
],
"host_permissions": [
  "http://www.blogger.com/",
  "http://*.google.com/"
],
```

--------------------------------

### Preferences JSON with supported_locales (macOS and Linux)

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/alternate-distribution-options

Use this JSON to install the extension only for specific locales. The supported_locales array lists parent locales; users with other locales will not get the extension, and changing locale uninstalls it.

```json
{
   "external_update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",
   "supported_locales": [ "en", "fr", "de" ]
}
```

--------------------------------

### Blocked Inline Event Handler Example

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/csp

An example where an inline onclick handler is blocked by the host page's CSP because it does not run immediately upon injection.

```javascript
document.write("<button onclick='alert(1);'>click me</button>'");
```

--------------------------------

### List directories to verify the cloned repo

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/samples/picture-viewer-popup-webpage

Use this command to list the contents of the current directory to confirm that the MicrosoftEdge-Extensions directory is present.

```console
ls
```

--------------------------------

### Update request for Extension 2

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/auto-update

Example request for an extension with ID bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb and version 0.4.

```https
http://contoso.com/extension_updates.php?x=id%3Dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%26v%3D0.4
```

--------------------------------

### .reg file to register native messaging host manifest

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/native-messaging

Create a .reg file with this content and run it to add the registry key. If run as part of a batch script, use an administrator command prompt.

```console
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Edge\NativeMessagingHosts\com.my_company.my_app]
@="C:\\path\\to\\nmh-manifest.json"

```

--------------------------------

### Switch to the working branch

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/samples/picture-viewer-popup-webpage

Use this command to switch to the newly created 'test' branch. The expected output is 'Switched to branch 'test''.

```console
git switch test
```

--------------------------------

### Update request for Extension 1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/auto-update

Example request for an extension with ID aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa and version 1.1.

```https
http://contoso.com/extension_updates.php?x=id%3Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%26v%3D1.1
```

--------------------------------

### DOM Injected Script Execution

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/csp

An example of injecting a script element into the DOM that executes successfully.

```javascript
var script = document.createElement('script');
script.innerHTML = 'alert(1);'
document.getElementById('body').appendChild(script);
```

--------------------------------

### Switch to the MicrosoftEdge-Extensions directory

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/samples/picture-viewer-popup-webpage

Use this command to change into the cloned MicrosoftEdge-Extensions directory.

```console
cd MicrosoftEdge-Extensions
```

--------------------------------

### Enable the extension's shortcut icon to open the sidebar - manifest.json

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/sidebar

Declare the "action" key in manifest.json to allow the action toolbar icon to open the sidebar.

```json
{
  "name": "My sidebar extension",
  ...
   "action": {
    "default_title": "Click to open sidebar"
  },
  ...
}
```

--------------------------------

### chrome.devtools.panels.create method call

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/devtools-extension

A simplified example of invoking the create method to register a new DevTools panel.

```javascript
chrome.devtools.panels.create("Custom", "icon.png", "panel.html", panel => {
    // code invoked on panel creation
});
```

--------------------------------

### Prohibited Eval-based JavaScript

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/developer-guide/csp

Examples of JavaScript patterns that are disabled by the default CSP because they evaluate strings as code.

```javascript
alert(eval("foo.bar.baz"));
window.setTimeout("alert('hi')", 10);
window.setInterval("alert('hi')", 10);
new Function("return foo.bar.baz");
```

--------------------------------

### REST Endpoint for v1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

The GET endpoint for checking publishing status using Bearer token authentication.

```REST
Endpoint: /v1/products/$productID/submissions/operations/$operationID
Type: GET
Header Parameters: Authorization: Bearer $TOKEN
```

--------------------------------

### Curl command to check package upload status v1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

Command line example to check package upload status using Bearer token authentication.

```Console
> curl \
-H "Authorization: Bearer $TOKEN" \
-X GET \
-v \
https://api.addons.microsoftedge.microsoft.com/v1/products/$productID/submissions/draft/package/operations/$operationID
```

--------------------------------

### REST Endpoint for v1.1

Source: https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/api/using-addons-api

The GET endpoint for checking publishing status using ApiKey and X-ClientID authentication.

```REST
Endpoint: /v1/products/$productID/submissions/operations/$operationID
Type: GET
Header Parameters: Authorization: ApiKey $ApiKey; X-ClientID: $ClientID
```