Examples

Real-world manifest-parsing scenarios. Every example is runnable Rust; copy any block into a binary, or feed the same manifest to the zovo.one scanner for a full security report.

1. Decode a minimal MV3 manifest

Parse identity fields and permissions in one call.

use crx_manifest_parser::Manifest;

let m = Manifest::from_json(r#"{
    "manifest_version": 3,
    "name": "My Extension",
    "version": "1.0.0",
    "permissions": ["activeTab", "storage"]
}"#)?;

assert_eq!(m.manifest_version, Some(3));
assert_eq!(m.name.as_deref(), Some("My Extension"));
assert_eq!(m.permissions, ["activeTab", "storage"]);
# Ok::<(), crx_manifest_parser::ParseError>(())

2. Flag broad host access

A https://*/* host permission means the extension can read every HTTPS site you visit. Surface it.

use crx_manifest_parser::Manifest;

let m = Manifest::from_json(r#"{ "host_permissions": ["https://*/*"] }"#)?;

let broad = m.host_permissions.iter()
    .any(|p| p.contains("*/*") && (p.starts_with("http") || p.contains("*.")));

if broad {
    println!("WARNING: extension requests access to every site");
}
# Ok::<(), crx_manifest_parser::ParseError>(())

3. List every injected content script

Content scripts run inside other pages — enumerate them so users know what gets injected where.

use crx_manifest_parser::Manifest;

let m = Manifest::from_json(r#"{
    "content_scripts": [
        { "matches": ["https://*.example.com/*"], "js": ["a.js"] },
        { "matches": ["<all_urls>"],              "js": ["b.js", "c.js"] }
    ]
}"#)?;

for (i, cs) in m.content_scripts.iter().enumerate() {
    println!("script {i}: js={:?} on {:?}", cs.js, cs.matches);
}
# Ok::<(), crx_manifest_parser::ParseError>(())

4. Summarize an extension's risk surface

Roll permissions, hosts, and content scripts into a one-line summary.

use crx_manifest_parser::Manifest;

let m = Manifest::from_json(r#"{
    "name": "Helper",
    "permissions": ["tabs", "cookies"],
    "host_permissions": ["https://*.example.com/*"],
    "content_scripts": [{ "matches": ["https://*.example.com/*"], "js": ["x.js"] }]
}"#)?;

println!(
    "{}: {} API perms, {} host perms, {} content scripts",
    m.name.as_deref().unwrap_or("(unnamed)"),
    m.permissions.len(),
    m.host_permissions.len(),
    m.content_scripts.len(),
);
# Ok::<(), crx_manifest_parser::ParseError>(())

5. Handle malformed JSON

ParseError carries the byte offset, so you can point at the bad token.

use crx_manifest_parser::Manifest;

match Manifest::from_json("{ broken") {
    Ok(_)  => println!("parsed"),
    Err(e) => println!("parse error at byte {}: {}", e.offset, e.message),
}

---

Next steps

For a full extension security report — every permission explained, every host flagged, every content script surfaced — paste the extension into the zovo.one scanner.