pes10k / web-api-manager

(Unmaintained) WebExtension based browser extension to manage and block untrusted parts of the Web API.
GNU General Public License v3.0
102 stars 16 forks source link

Allow a more compatible, less safe mode #73

Closed pes10k closed 6 years ago

pes10k commented 6 years ago

Blocking the parent frame from reaching into iframes provides increased security (by preventing pages from side-stepping the API blocking by reaching into child frames), but breaks sites that non-maliciously write into / out of iframes.

It would be good to add a "more compatible" option, that allows frames to reach into the DOMs of child frames, but still makes a "best effort" at blocking the DOM in the parent frame.