search

yamayamayamaji / Keyboard-Shortcuts-for-Google-Translate

chrome extension Keyboard Shortcuts for Google Translate
44 stars 1 forks source link

question about permissions #1

Closed MyDogTom closed 8 years ago

MyDogTom commented 9 years ago

Hi. Why is plugin need permission: "Read and change all data on websites you visit"? Is it possible to have only "Read and change data on translate.google.com"? (or something like this)

yamayamayamaji commented 9 years ago

Hi, thank you for a question.

I want to do so but ...

URL of google translate website is not only

but also

etc...

and this plugin is necessary to work on these URLs.

So I specified content_scripts field like this in the manifest.json.

  "content_scripts": [ {
    ...
    "matches": ["*://*/*"],
    "include_globs": ["*://translate.google.*/*"],
    ...
  } ],

I think this means that the plugin work only when URL matches "://translate.google./*". Match patterns and globs

The content script will be injected into a page if its URL matches any matches pattern and any include_globs pattern, as long as the URL doesn't also match an exclude_matches or exclude_globs pattern. Because the matches property is required, exclude_matches, include_globs, and exclude_globs can only be used to limit which pages will be affected.

But Chrome brings up the following warning: "Read and modify all your data on all websites you visit" because a "content_scripts" field with a "matches" entry that matches all hosts.

If possible, I want to specify "matches" field like

    "matches": ["*://translate.google.*/*"],

but this is impossible according to rule of match patterns.

If '*' is in the host, it must be the first character

:pensive:

MyDogTom commented 9 years ago

Now it is clear. Thank you for your answer and for the great extension!

evansendra commented 8 years ago

Thanks for linking me here from the support tab...props to you for making the effort to minimize scope of permissions. Sucks that there's no wildcard for big company's like google who own many TLDs.

While it would be nothing more than a major pain-in-the-ass, I'd say you should probably still explicitly list all the TLDs in the manifest just so users don't get scared off by the "change all the data on all the sites you visit" perm. For all the TLDs you'd have to list, see here:

https://en.wikipedia.org/wiki/List_of_Google_domains

yamayamayamaji commented 8 years ago

Nice advice. That makes sense :smile:

I will try to list all TLDs.

yamayamayamaji commented 8 years ago

released ver2.0.3.0 .