Chrome privileges - userscripts work on about: pages (about:addons, about:healthreport...)

[janekptacijarabaci]

Ad #1375 (comment)

I don't know if this is a solution:
https://github.com/janekptacijarabaci/greasemonkey/tree/aboutBlank

[Ventero]

A few questions on this general topic (let me know if I should take this to the mailing list):

• We currently only run scripts on about:blank if they specifically request it (i.e., not if they only @include *. If I'm understanding the logic of this patch correctly, this changes it to only run if additionally, the about:blank window doesn't have any other (i.e. non-blank) about: ancestors. How about only allowing about:blank if it's the top level window? In many cases, frames start with an about:blank URI before having their location changed, and injecting about:blank scripts into those doesn't make too much sense.
• What's the current consensus on allowing scripts to run on pages with chrome privileges? We do allow data/about URIs (which can have chrome privileges) if the user enables the preference. I assume allowing any chrome privileged URIs by default is a no-go?

[arantius]

User scripts should never get chrome privileges.

Those preferences should probably be removed sooner than treating them as precedent to do anything.

[janekptacijarabaci]

Chrome privileges:
See also #1302, #1375, #1767, #1917

Ad #1375 (comment):
This solves the implementation #1859 (perhaps)