Feature request to ad an additional mode

[Kees1958]

HI, nice works

I have a request. Could you add two mode's which uses

1. Permissive plus mode with restrictions: blocking unsafe (eval, inline wasm)
2. Permissive plus plus mode with restrictions and ultra lite sandbox (allowing everything except downloads and popups)

This two extra baseline modes would increase security (1 = permissive +) and reduce annoyances (2 = permissive ++) while allowing most (neatly designed) websites to work normally.

[alexlingerie]

To help move this forward, here is a draft of how these two additional modes can be structured as native Manifest V3 declarativeNetRequest rules to append or modify the Content-Security-Policy header.1. Permissive Plus (permissive-plus)This rule modifies the response headers to remove unsafe-eval and inline WebAssembly execution from the script-src and wasm-src directives.json{
"id": 101,
"priority": 1,
"action": {
"type": "modifyHeaders",
"responseHeaders": [
{
"header": "Content-Security-Policy",
"operation": "append",
"value": "script-src 'self' 'unsafe-inline' http: https:; object-src 'none';"
}
]
},
"condition": {
"resourceTypes": ["main_frame", "sub_frame"]
}
}
Permissive Plus Plus (permissive-plus-plus)This rule enforces a lightweight sandbox via CSP headers. By explicitly omitting allow-downloads and allow-popups from the sandbox tokens, the browser automatically blocks forced files and new windows while letting the rest of the site function normally.json{
"id": 102,
"priority": 1,
"action": {
"type": "modifyHeaders",
"responseHeaders": [
{
"header": "Content-Security-Policy",
"operation": "append",
"value": "sandbox allow-scripts allow-forms allow-same-origin allow-modals allow-pointer-lock; script-src 'self' 'unsafe-inline' http: https:;"
}
]
},
"condition": {
"resourceTypes": ["main_frame", "sub_frame"]
}
}

Matrix³ UIThese rules can be mapped directly to two new toggles in the matrix grid or options menu, allowing users to activate them globally or per-domain by injecting these specific rule IDs into the active dynamic ruleset.

[alexlingerie]

To complete the policy spectrum alongside the permissive modifications, here is a proposal for a Strict Secure Mode (secure.json). This baseline provides maximum hardening by implementing a "default-deny" approach to structural and executable subresources.

3. Strict Secure Mode (secure)

This profile disables all third-party scripting, frame embedding, and plugin execution by default, isolating the browser to process strictly static asset types (styles, basic images, and local fonts).

{
"id": 103,
"priority": 2,
"action": {
"type": "modifyHeaders",
"responseHeaders": [
{
"header": "Content-Security-Policy",
"operation": "append",
"value": "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https:; frame-src 'none'; object-src 'none'; base-uri 'none';"
}
]
},
"condition": {
"resourceTypes": ["main_frame", "sub_frame"]
}
}

Key Technical Aspects of this Policy:

• default-src 'none';: Completely shuts down any network connection or fetching mechanism not explicitly whitelisted later in the directive.
• script-src 'self';: Strips out all inline scripts and third-party remote scripts, eliminating the vast majority of XSS vulnerabilities and tracking networks.
• frame-src 'none'; object-src 'none';: Neutralizes UI redressing, clickjacking, and browser component/plugin exploitation vectors entirely.
• Visual Fallbacks: It leaves style-src and img-src partially open for HTTPS endpoints so that basic text layouts and layouts don't completely collapse, allowing reading-only tasks on untrusted websites.

Offering these three defaults (permissive-plus, permissive-plus-plus, and secure) would give matrix³ a robust, comprehensive security ladder right out of the box.