v2: CORS issues when reducing permissions

As seen in #100, but also happens when trying to render gitlab pages, the combination of (1) an extension page and (2) not having full host privileges, can cause the extension page to fail to fetch the markdown:

E.g. opening ext+view-markdown:https://gitlab.com/gitlab-org/gitlab-foss/-/raw/master/doc/install/requirements.md This causes the following error, followed by a link to this docs page:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://gitlab.com/gitlab-org/gitlab-foss/-/raw/master/doc/install/requirements.md. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

Here are the headers for that page:

https://gitlab.com/gitlab-org/gitlab-foss/-/raw/master/doc/install/requirements.md
Host: gitlab.com
User-Agent: <user agent>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: <cookie>
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
GET: HTTP/2.0 304 Not Modified
date: Sun, 29 Jan 2023 18:29:16 GMT
cache-control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60
content-disposition: inline
content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://gitlab.com/assets/ blob: data:; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com snowplow.trx.gitlab.net; default-src 'self'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-cloudresourcemanager.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://*.codesandbox.io https://customers.gitlab.com https://*.zuora.com/apps/PublicHostedPageLite.do; img-src * data: blob:; manifest-src 'self'; media-src 'self' data: http: https:; object-src 'none'; report-uri https://sentry.gitlab.net/api/105/security/?sentry_key=a42ea3adc19140d9a6424906e12fba86; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-TkcXd3d4quEYg7ChmKQ4IQ=='; style-src 'self' 'unsafe-inline'; worker-src https://gitlab.com blob: data:; form-action 'self' https: http: http:
etag: "<hash>"
permissions-policy: interest-cohort=()
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: <hash>
x-runtime: 0.131158
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block
gitlab-lb: fe-30-lb-gprd
gitlab-sv: web-gke-us-east1-b
cf-cache-status: HIT
age: 12
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bnt6muaiTZWkJxndIP82FcM3OHoClJbIxFkbqt4xDBLtDpYHwSJMZExV5kgOjcZyibqewwlP168MYXZNukFfGF3lcMe9vzgK1BjB3vMvSdY%2Fo%2FeD1ggNWgjGif5Qn1s2Zlohc8J2nGw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
strict-transport-security: max-age=31536000
server: cloudflare
cf-ray: 791408493bf9dcbb-LHR
X-Firefox-Spdy: h2

This doesn’t happen when keeping all permissions, or when injecting into the page (i.e. without redirecting to an extension page) from the navigation bar button, because in both cases we have host permissions.

Cimbali / markdown-viewer

v2: CORS issues when reducing permissions #101