Proposal: add `disallow_host_permissions`

[carlosjeurissen]

Related to the 2021-10-28 meeting about host permissions. As a developer, it can be helpful to determine a set of host_permissions which should not be granted to the extension.

An example could be granting permission for *.google.com yet excluding accounts.google.com due to security concerns. In this case it would basically have the same effect as having the user go to accounts.google.com and then remove host permissions from there.

[xeenon]

This sounds good. I support this for Apple.

[carlosjeurissen]

This issue has been mentioned in Publish minutes of 2022-02-03 meeting.

Apple Safari and Mozilla Firefox seem to be in favor. @dotproto mentioned he will share Google's view async.

[rdcronin]

I'm supportive of this in Chrome. Allowing extensions to opt into reduced permissions always sounds good to me.

[Jack-Works]

what will happen if the extension programmatically & explicitly requests permission for the disallowed host?

e.g. in the case above, it's account.google.com

[carlosjeurissen]

@Jack-Works There are a few paths to take.

1. Raise an exception when requesting this permission / give an error when manifest host permissions colide.
2. Return as permission not granted
3. Just granting it yet have another layer in which the disallowed_host_permissions are subtracted.

@Jack-Works What do you think would be most logical here?

[Jack-Works]

@carlosjeurissen I believe it should be rejected.

[carlosjeurissen]

@Jack-Works So basically you are saying, when an extension author requests permissions for host X, Y, and for permission Z. Say host X is a disallowed_host_permission. The whole request should be rejected and no permission request should be displayed to the user?

There are some edge cases, like what if a more specific host_permission is requested. Say https://*.example.com/ is in disallowed_host_permission, and permission for https://accounts.example.com/ is requested. Should this be rejected as well?

Not sure there is a concept of partially granted permissions after / during a permission prompt. This could potentially be helpful.