docs: justify host_permissions <all_urls> scope for Store review - #92
Merged
knytcomics-ui merged 1 commit intoJul 22, 2026
Merged
Conversation
Adds docs/permissions.md explaining why the current <all_urls> +
document_start MAIN-world injection scope is required: the set of
sites embedding Stellar wallet-signing calls isn't knowable in advance
(any dApp/DEX/marketplace can), and interception must happen before
user interaction, which activeTab's grant-on-invocation model can't
provide - a signing call frequently fires as part of normal page load,
before the user has any reason to click the extension icon.
Documents activeTab + optional_host_permissions ("enable on this
site") as the alternative considered, and why it's deferred rather
than adopted now (reintroduces the same timing gap, and its opt-in
prompt would leave exactly the unfamiliar/risky first-visit sites
unprotected - the core value proposition). Also notes the mitigations
already in place (CSP scoped to 'self', no tabs/webRequest/scripting
permissions, MAIN-world injection limited to the two files that need
it).
This intentionally does not attempt the activeTab/optional-permissions
rewrite itself: that's a real behavior change to interception timing
that needs manual verification against a live Freighter install before
shipping, per the issue's own Definition of Done, and is left for
separate follow-up work.
Closes Gryd-lock#5
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/permissions.mdwith a written justification for the current<all_urls>host permission +document_startMAIN-world content-script scope, per the "documented allowlist rationale if broad access is unavoidable" path in the issue.activeTab+optional_host_permissionswas considered and deferred: its grant only exists after the user invokes the extension, but signing calls frequently fire during normal page load — before there's any reason for the user to click the icon — so it reintroduces the exact timing gap<all_urls>+document_startexists to close, and its opt-in prompt would leave first-visit/unfamiliar dApps (the actual threat model) unprotected.README.md's Security section.This PR deliberately does not attempt the
activeTab/optional-permissions rewrite itself — that's a real interception-timing behavior change that the issue's own Definition of Done says needs manual verification against a live Freighter install, existing test updates, and CI passing, none of which this pass covers. Left as follow-up work if the team decides to pursue the narrower scope instead of the documented-justification path.Closes #5