brave / brave-core-crx-packager

Mozilla Public License 2.0
41 stars 35 forks source link

Create Sentry alert for upstream filter rules that use trusted-types scriptlet #958

Open ShivanKaul opened 3 months ago

ShivanKaul commented 3 months ago

We're going to be using the trusted-types scriptlet to counter YouTube ads: https://github.com/brave/adblock-lists/pull/1933 (currently in Experimental, will be rolled out to all soon). Overriding Trusted Types is potentially dangerous, since the website puts the policy in place to prevent XSS attacks.

We don't currently use the trusted-types scriptlet anywhere else, but we should not accidentally inherit it from upstream. I propose checking this during the adblock lists packaging job. Note that we want to make sure we don't accidentally block the YT rule, so we should allow that one in particular.