Filtering rules limitations (custom filter, user filter)

[ameshkov]

@ameshkov commented on Tue Dec 18 2018

1. Custom filters must not support powerful modifiers ($replace and JS) unless they are explicitly enabled by the user filter (there should be a "Trusted" checkbox in the custom filter dialog)
2. Change the CSS rules validation process and discard those with url in the style text

[ ] Trusted filter
Filters marked as trusted can use powerful filtering rules modifiers which can be dangerous in the wrong hands. Do not check this box unless you fully trust it.

Pre-installed filters are marked as trusted by default (as we perform validation on the server-side).