{"action":"created","issue":{"url":"https://api.github.com/repos/greasemonkey/greasemonkey/issues/2420","repository_url":"https://api.github.com/repos/greasemonkey/greasemonkey","labels_url":"https://api.github.com/repos/greasemonkey/greasemonkey/issues/2420/labels{/name}","comments_url":"https://api.github.com/repos/greasemonkey/greasemonkey/issues/2420/comments","events_url":"https://api.github.com/repos/greasemonkey/greasemonkey/issues/2420/events","html_url":"https://github.com/greasemonkey/greasemonkey/pull/2420","id":171024644,"number":2420,"title":"WIP: provide APIs to bypass CSP restrictions","user":{"login":"the8472","id":1065730,"avatar_url":"https://avatars.githubusercontent.com/u/1065730?v=3","gravatar_id":"","url":"https://api.github.com/users/the8472","html_url":"https://github.com/the8472","followers_url":"https://api.github.com/users/the8472/followers","following_url":"https://api.github.com/users/the8472/following{/other_user}","gists_url":"https://api.github.com/users/the8472/gists{/gist_id}","starred_url":"https://api.github.com/users/the8472/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the8472/subscriptions","organizations_url":"https://api.github.com/users/the8472/orgs","repos_url":"https://api.github.com/users/the8472/repos","events_url":"https://api.github.com/users/the8472/events{/privacy}","received_events_url":"https://api.github.com/users/the8472/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-08-13T19:55:54Z","updated_at":"2016-08-14T22:54:27Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/greasemonkey/greasemonkey/pulls/2420","html_url":"https://github.com/greasemonkey/greasemonkey/pull/2420","diff_url":"https://github.com/greasemonkey/greasemonkey/pull/2420.diff","patch_url":"https://github.com/greasemonkey/greasemonkey/pull/2420.patch"},"body":"Not finished yet. The question is, would you accept the following set of new features?\r\n\r\n* `@grant baseDomain`. this would use a subsuming principal for the sandbox, e.g. `mail.google.com` -> `google.com`. The principal could then use the same OriginAttributes (i.e. containers, 1st party siloing etc.) but ignore CSP\r\n* `@grant isolateFetch`. add sandbox specific XHR and `fetch` constructors. They would still respect SOP/CORS but when combined with the baseDomain grant they would not be subject to CSP. I.e. they would be less powerful than GM_XHR but more powerful than the page's XHR.\r\n* `@grant GM_blobURI`. This would allow the user to generate privileged URIs which bypass CSP. \r\n\r\nI.e. it could do something like this without running afoul of img-src CSPs:\r\n\r\n```javascript\r\n// ==UserScript==\r\n// @name        gm_blob test\r\n// @namespace   test\r\n// @version     1\r\n// @grant       GM_blobURI\r\n// @grant       baseDomain\r\n// @grant       isolateFetch\r\n// ==/UserScript==\r\n\r\n\"use strict\";\r\n\r\n[...document.querySelectorAll(\"img\")].forEach(img => {\r\n  fetch(img.src).then(rsp => {\r\n    return rsp.blob()\r\n  }).then(blob => {\r\n    let [gmuri, revoker] = GM_blobURI(blob)\r\n    img.src = gmuri\r\n  }).catch(err => {\r\n    console.log(err)\r\n  })\r\n})\r\n```"},"comment":{"url":"https://api.github.com/repos/greasemonkey/greasemonkey/issues/comments/239702873","html_url":"https://github.com/greasemonkey/greasemonkey/pull/2420#issuecomment-239702873","issue_url":"https://api.github.com/repos/greasemonkey/greasemonkey/issues/2420","id":239702873,"user":{"login":"the8472","id":1065730,"avatar_url":"https://avatars.githubusercontent.com/u/1065730?v=3","gravatar_id":"","url":"https://api.github.com/users/the8472","html_url":"https://github.com/the8472","followers_url":"https://api.github.com/users/the8472/followers","following_url":"https://api.github.com/users/the8472/following{/other_user}","gists_url":"https://api.github.com/users/the8472/gists{/gist_id}","starred_url":"https://api.github.com/users/the8472/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the8472/subscriptions","organizations_url":"https://api.github.com/users/the8472/orgs","repos_url":"https://api.github.com/users/the8472/repos","events_url":"https://api.github.com/users/the8472/events{/privacy}","received_events_url":"https://api.github.com/users/the8472/received_events","type":"User","site_admin":false},"created_at":"2016-08-14T22:54:27Z","updated_at":"2016-08-14T22:54:27Z","body":"I mean we could also just skip the first two grants and change the behavior to always match what webextensions do. That would leave `GM_blobURI`, which could be specified to maybe or maybe not do any more than `URL.createObjectURL()`.\r\n\r\nI just wanted to provide explicit opt-ins to avoid possibly breaking existing scripts."}}
{"actor":{"display_login":"the8472"}}