Add Permission Explanation

[FlorianWendelborn]

It'd be really nice to know why this plugin needs the permissions it requests, especially why it needs to view my browser history.

I can't think of any reason why it would need the history, so at this point this makes the plugin quite untrustworthy TBH.

[Justineo]

The extension currently relies on Chrome Extension's webNavigation API to dynamically inject content script into the webpage because users can set site URL for GitHub Enterprise so the injection has to be dynamic. For each time you visit a URL, the extension will try to match the URL against the options and decide whether to inject content scripts, see here.

The use of webNavigation leads to the warning message you see, according to this issue.

[Justineo]

I just added this into FAQ. Thanks for reporting your concerns. I'll try to find a better solution for this.

[Justineo]

I checked the way Octotree handles this problem. It tries to inject content scripts into every webpage and if it got an error (because of no permission granted for most sites) it stops. Octotree won't know the exact URL you are visiting but if no error occurs it knows that the site's permission is already granted. GitHub Hovercard tries to make sure the site you are visiting is already in the granted list before it injects content scripts by using the webNavigation module. It won't exploit the actuall URL either. Actually I prefer GitHub Hovercard's current logic because it seems to be cleaner, though it may cause some concerns for privacy.

[FlorianWendelborn]

@Justineo sounds like a huge oversight from Chromium IMHO. They should've implemented a method to check if you have permission on the current site.

[fregante]

You can now remove that permission by using 2 modules I wrote recently:

https://github.com/fregante/webext-domain-permission-toggle
https://github.com/fregante/webext-dynamic-content-scripts

You'd just need these and some adjustments to manifest.json

npm i webext-domain-permission-toggle webext-dynamic-content-scripts

// in background.js
import 'webext-dynamic-content-scripts';
import addDomainPermissionToggle from 'webext-domain-permission-toggle';

addDomainPermissionToggle();