Allow webgl ONLY on https://www.google.com/maps/ and subpages

[Anged]

Hello,
Basically, I want to allow webgl on this regex: /^https:\/\/www\.google\.com\/maps\/.+/

Here's my current exported conf:

Code: Select all

"custom": {
  "https://www.google.com/maps/": {
    "capabilities": ["script", "webgl", "fetch"]
  }
}

This works if I go manually to google.com/maps and then browse from there, but if I reload the page or follow a shared link, noscript doesn't match anymore, I assume because of everything after /maps/...

I could put §:www.google.com but I'm not a fan of allowing everything under the google domain...

[barbaz]

NoScript permissions don't have that level of granularity.

NoScript is a security tool. In NoScript's trust model, either you trust a site or you don't. Since a malicious site could easily put malicious resources at any path, trusting by path prefix in this model would give a false sense of security.

NoScript's support for allowing individual paths is only exact paths, which exists so that blocked object placeholders work as expected.