Permissions exposure and message changes

Question

Created Jul ’20

Replies 3

Boosts 0

Views 1.2k

Participants 3

I have been working on an extension which I migrated with xcrun safari-web-extension-converter PATH.

When I press extension button on safari toolbar it shows me message like,

This extension would be able to read and alter webpages and see your browsing history on this website. This could include sensitive information, including passwords, phone numbers, and credit cards.

However, my extension is only accessing url to bookmark it and localstorage to access user tokens, tabs so new tab with somedomain.in can be opened open bookmarked link into new tab.

Here is excerpt from manifest.json,

Code Block "permissions" : [
  "*://*.domain.in/*",
  "activeTab",
  "storage",
  "notifications",
  "tabs"
 ],
"optional_permissions": ["activeTab", "*://*.domain.in/*"],
  
 "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",
 "web_accessible_resources": [
  "corner.css",
  "js/init.js",
  "init.bundled.js",
  "js/jquery.min.js",
  "js/taggle.min.js",
  "js/typeahead.bundle.min.js",
  "ext.html.js",
  "assets/*"
 ],

It feels access to sensitive information is a bit scary for extension which just stores and manages URLs. Would you suggest me any solution over here so I can use limited permission and avoid sensitive info message..?

Boost

Answer 1

Frameworks Engineer OP

Apple

Jul ’20

If you only need the URL of the active tab, then you don’t need to include the tabs permission. This should remove the permission popover.

Also no need to duplicate permissions in optional_permissions.

If you do need more permissions later you should only need activeTab permissions and then explicitly request more permission via browser.permissions.request() and optional_permissions.

0

Answer 2

mobihunterz OP

Jul ’20

I tried above changes still my message seems nearly same and it points for Credit card details, etc.

As mentioning below,

The extension “ABC” would like to access stackoverflow.com.

This extension would be able to read and alter webpages and see your browsing history on this website. This could include sensitive information, including passwords, phone numbers, and credit cards.

You can change this later in Safari Websites preferences.

In my manifest.json, I have removed all permission but activeTab, still facing same privacy message. Is this default from Apple? It seems a bit scary as it states we have access to user's credit card details, etc.

0

Answer 3

thianphat OP

Dec ’23

Getting this issue too, did anyone by chance figure it out? Thanks

0