search

ka-extension / ka-extension-ts

A browser extension for Khan Academy.
MIT License
19 stars 11 forks source link

Complience with Mozilla guidelines #190

Open MatthiasPortzel opened 4 years ago

MatthiasPortzel commented 4 years ago

The KA Extension was recently removed from the Mozilla webstore for the following issues:

Additionally, they are asking for a privacy policy.

I have no plans to address these problems at this time.

JettBurns14 commented 3 years ago

I don't recall working on the Ace scripts feature, so not sure how that'd be fixed.

Regarding unsanitized data, perhaps we can add a general checker/filtering function every time we inject data into HTML. I can imagine users getting creative and possibly getting an alert popup if they really tried, but I haven't heard of any issues coming from this design of ours.

I'm fine writing a privacy policy, if we fix the other issues. I welcome any PRs which get the ball rolling on these things!

I'd like to get the extension back on Firefox one day... but I'm busy with other things currently. Would love to get back into this project if I get some time!

MatthiasPortzel commented 3 years ago

Yeah, there's no security issue with our implementation, our data is sanitized, it's just an issue of best practice. They would like us to use DOM manipulation instead of creating the elements from HTML strings.