Site Permissions: 'Disable browser extensions for this site'
Categories
(WebExtensions :: Untriaged, enhancement)
Tracking
(Not tracked)
People
(Reporter: mail, Unassigned)
References
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:75.0) Gecko/20100101 Firefox/75.0
Actual results:
Currently Add-Ons (extensions) present a risk to users as content-scripts can run in all frames of a browser hooking any DOM element or event without the ability for a website to protect this.
Being able to secure a user from being skimmed in certain iframes used in online banking/credit-card-processing is very important.
Expected results:
I'd like to request an additional permission enum be added to
https://w3c.github.io/permissions/#enumdef-permissionname
"block-content-scripts" such that a site can ask the user permission to restrict content-scripts from running in a given portion of the site.
e.g.
navigator.permissions.query({name:'block-content-scripts', frame-src: 'example.com'}).then(function(result) {
if (result.state == 'granted') {
...
Once this permission is granted the site can refresh and content-scripts will be blocked from the DOM
|
Reporter | |
Updated•4 years ago
|
|
||
Comment 1•4 years ago
|
||
+1
|
||
Comment 2•4 years ago
|
||
Bugbug thinks this bug should belong to this component, but please revert this change in case of error.
|
||
Updated•4 years ago
|
|
||
Comment 4•4 years ago
|
||
This reporter is asking for websites to be allowed to restrict webextensions from running. AFAIK bug 1497075 is about users being able to disable webextensions on specific pages.
|
|
||
Comment 5•4 years ago
|
||
Ah, you're right thanks for catching that. I'm having a hard time seeing a compelling case for this but the addons team can decide.
|
|
Reporter | |
Comment 6•4 years ago
|
||
Yes, [:evilpie] is right this is for a site being able to request content script injection blocking, similar to how it can make a request for geolocation or camera.
Are you able to remove the duplicate tag so this is still triaged?
Thanks!
|
||
Comment 7•4 years ago
|
||
We won't allow websites to disable content scripts. We see more value in offering the ability to toggle extensions for specific (groups) of websites (beyond content scripts), through bug 1365019 for example.
Description
•