starred/floccus

Fork 0

mirror of https://github.com/floccusaddon/floccus.git synced 2026-04-25 22:26:06 +03:00

` instead of `activeTab` permission? #480

New issue

Closed

opened 2026-02-25 22:37:17 +03:00 by kerem · 4 comments

kerem commented

2026-02-25 22:37:17 +03:00

Owner

Originally created by @krsch on GitHub (Dec 24, 2020).
Original GitHub issue: https://github.com/floccusaddon/floccus/issues/751

Is your feature request related to a problem? Please describe.
I think giving an extension permission to access and modify data on all pages greatly increases a possible attack surface: a vulnerability in any of the extensions gives an attacker just too much access.

Describe the solution you'd like
Web extensions allows a developer to specify the activeTab permission. As MDN puts it "If an extension has the activeTab permission, then when the user interacts with the extension, the extension is granted extra privileges for the active tab only." Chrome store considers this permission harmless enough to hide it when showing extension permissions.

Describe alternatives you've considered
Another alternative is to remove https://*/ permission. I don't see how floccus uses it.

Additional context
activeTab permission is described on MDN and Chrome Developers

Originally created by @krsch on GitHub (Dec 24, 2020). Original GitHub issue: https://github.com/floccusaddon/floccus/issues/751 **Is your feature request related to a problem? Please describe.** I think giving an extension permission to access and modify data on all pages greatly increases a possible attack surface: a vulnerability in any of the extensions gives an attacker just too much access. **Describe the solution you'd like** Web extensions allows a developer to specify the `activeTab` permission. As MDN puts it "If an extension has the activeTab permission, then when the user interacts with the extension, the extension is granted extra privileges for the active tab only." Chrome store considers this permission harmless enough to hide it when showing extension permissions. **Describe alternatives you've considered** Another alternative is to remove `https://*/` permission. I don't see how floccus uses it. **Additional context** `activeTab` permission is described on [MDN](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#activeTab_permission) and [Chrome Developers]( https://developer.chrome.com/docs/extensions/mv2/manifest/activeTab/)

kerem

2026-02-25 22:37:17 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-25 22:37:17 +03:00

Author

Owner

@marcelklehr commented on GitHub (Dec 31, 2020):

See the README section on permissions

@marcelklehr commented on GitHub (Dec 31, 2020): See the [README section on permissions](https://github.com/marcelklehr/floccus#permissions)

kerem commented

2026-02-25 22:37:17 +03:00

Author

Owner

@krsch commented on GitHub (Jan 1, 2021):

Sorry, didn't find it README. Isn't it possible switch to Permission API and runtime permissions?

@krsch commented on GitHub (Jan 1, 2021): Sorry, didn't find it README. Isn't it possible switch to Permission API and runtime permissions?

kerem commented

2026-02-25 22:37:17 +03:00

Author

Owner

@marcelklehr commented on GitHub (Jan 1, 2021):

That's a good idea. I'll look into that, once the current issues have been resolved.

@marcelklehr commented on GitHub (Jan 1, 2021): That's a good idea. I'll look into that, once the current issues have been resolved.

kerem commented

2026-02-25 22:37:17 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 21, 2023):

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions[bot] commented on GitHub (Mar 21, 2023): This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

kerem referenced this issue

2026-02-25 22:40:43 +03:00

[PR #480] [MERGED] Replace localforage with browser extension storage. Fixes #459 #1594

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/floccus#480

No description provided.

Rows
Columns

[GH-ISSUE #751] Why does floccus require https://*/ instead of activeTab permission? #480

[GH-ISSUE #751] Why does floccus require `https://*/` instead of `activeTab` permission? #480