alexwforsythe / code-blocks

Syntax highlighting for Google Docs
https://www.alexwforsythe.com/code-blocks/
MIT License
702 stars 89 forks source link

Security issue #206

Closed charles30l closed 2 years ago

charles30l commented 2 years ago

If you remove the plugin from a document through google's interface (uncheck it), the plugin does not remove its permissions on said document. You can still run it on the doc until you completely uninstall the add-on from the account.

Basically, once you add the plugin to a doc, it is always there. No screenshots because my company cares about this, and had to forcibly remove it from the doc I was working on.

Easy to reproduce though:

  1. Install add-on to account
  2. In a google doc go to manage add-ons
  3. add it to doc
  4. format something as intended
  5. go back to manage add-ons
  6. uncheck it

No matter what you do from here it will always be able to run on this document until removed from the account entirely.