Activity

1. Justineo commented on Aug 13, 2016

   

   Justineo

   on Aug 13, 2016

   Last edited by Justineo

   Owner

   More actions

   The extension currently relies on Chrome Extension's webNavigation API to dynamically inject content script into the webpage because users can set site URL for GitHub Enterprise so the injection has to be dynamic. For each time you visit a URL, the extension will try to match the URL against the options and decide whether to inject content scripts, see here.

   The use of webNavigation leads to the warning message you see, according to this issue.

   👍React with 👍2Reacted by Florian Wendelborn and jason zhang
2. Justineo commented on Aug 13, 2016

   

   Justineo

   on Aug 13, 2016

   Owner

   More actions

   I just added this into FAQ. Thanks for reporting your concerns. I'll try to find a better solution for this.

   🎉React with 🎉1Reacted by Florian Wendelborn
3. Justineo commented on Aug 18, 2016

   

   Justineo

   on Aug 18, 2016

   Owner

   More actions

   I checked the way Octotree handles this problem. It tries to inject content scripts into every webpage and if it got an error (because of no permission granted for most sites) it stops. Octotree won't know the exact URL you are visiting but if no error occurs it knows that the site's permission is already granted. GitHub Hovercard tries to make sure the site you are visiting is already in the granted list before it injects content scripts by using the webNavigation module. It won't exploit the actuall URL either. Actually I prefer GitHub Hovercard's current logic because it seems to be cleaner, though it may cause some concerns for privacy.
4. FlorianWendelborn commented on Aug 19, 2016

   

   FlorianWendelborn

   on Aug 19, 2016

   Author

   More actions

   @Justineo sounds like a huge oversight from Chromium IMHO. They should've implemented a method to check if you have permission on the current site.
5. Justineo

   closed this as completedon Sep 17, 2016
6. fregante commented on Aug 7, 2019

   

   fregante

   on Aug 7, 2019

   Last edited by fregante

   More actions

   You can now remove that permission by using 2 modules I wrote recently:

   https://github.com/fregante/webext-domain-permission-toggle
   https://github.com/fregante/webext-dynamic-content-scripts

   You'd just need these and some adjustments to manifest.json

   npm i webext-domain-permission-toggle webext-dynamic-content-scripts

   // in background.js
   import 'webext-dynamic-content-scripts';
   import addDomainPermissionToggle from 'webext-domain-permission-toggle';
   
   addDomainPermissionToggle();