Access permission for all sites

[kirk781]

This is so the extension can gather content from the sources. We need to be able to reach those sources. Unfortunately that requires us to request the permissions from all sites.

If only the specific sources permission is required, why ask for access to all sites? For eg, RES only requests data for reddit.com* domain and other optional sites,if related. I don't understand why the extension needs access to say, Github for example.

Edit: I just saw that extension is disabled on other sites by default, so it's not a security risk.
It still shows as Can read and change data on this site for eg, when even viewing Github even when the Extension is obviously disabled on Github; so I am confused. Can the dev possibly clarify on this issue?

[Arioi-Rites]

I may not be a dev here, but since you never received an answer, I looked into this:

Analysis

The extension manages its own whitelist (src/utils/storage.ts) which is securely gated behind the "Grant Access" page (src/tabs/PermissionRequest.tsx). All websites you whitelist through this custom system receive unlimited CORS access (src/utils/declarativeNetRequest.ts) and the ability to read cookies for all sites matching the regex over in src/utils/storage.ts, within the hostsWithCookiesAccess variable. Those sites are exclusively streaming sites.

Risks

If you have accounts for any of the cookie accessible sites, you potentially expose yourself to impersonation attacks from all whitelisted sites, but it's highly unlikely any normal person has an account for those.

Apart from that; Unlimited CORS access might sound bad, but it only allows unlimited querying of public APIs. So unless a website has very bad verification, this should not even allow for de-anonymization.

As of the time of writing:

• Privilege escalation (as in: something adding itself to the whitelist without your consent) should, as far as I can tell, not be possible within the extension.
• The code of the extension here matches that on the FireFox store (although its minified over there).

Then why grab permission for <all_urls>?

I suppose the reason is simple. There are many websites using this plugin. Most instances listed over on https://erynith.github.io/movie-web-instances/ do. One could always be taken down and another put up. If you don't allow all sites, you'd need to have someone curate a list here and modify it every time anyone decided to self-host a new instance. This would be gatekeepy and I'd venture to say this is the reason why it was solved with a custom whitelist.

Conclusion

Despite the extension requesting the high privilege of running on all sites, you are most likely safe even if a malicious user or the feds were to take over a whitelisted site. Just practice basic data and cyber security, as everyone should if they utilize websites such as the ones this extension is fashioned for, and you should be fine.

I'd also recommend disabling automatic updates for the extension after installing, just in case a malicious actor does take control of it.

As for what sites to whitelist, either ask around in the community, or just rely on the highly reputable movie-web person, who, on the site I linked above, ranked some of the instances by how much they trust the hosts.