-
Notifications
You must be signed in to change notification settings - Fork 4k
Description
There is currently no filter option for cspreport with ABP filter syntax, and this means that if one wants to block all CSP reporting with a static filter, the other option has to be used, and this of course would probably lead to a lot of false positives since other is used for everything else which does not match one of the existing request types.
There are privacy considerations arising from CSP reporting, as spelled out in Reporting API / Privacy Considerations.
One key excerpt which explains well the rationale for the proposed new per-site switch (my emphasis):
That said, it can’t be the case that this general benefit be allowed to take priority over the ability of a user to individually opt-out of such a system. Sending reports costs bandwidth, and potentially could reveal some small amount of additional information above and beyond what a website can obtain in-band ([NETWORK-ERROR-LOGGING], for instance). User agents MUST allow users to disable reporting with some reasonable amount of granularity in order to maintain the priority of constituencies espoused in [HTML-DESIGN-PRINCIPLES].
I currently know no way in either Chromium or Firefox to "disable reporting with some reasonable amount of granularity", let alone do it easily.
I am also concerned that in the Reporting API document, it is said that network requests of the new Reporting API are made "out of band", which I believe could mean "behind-the-scene" in uBO parlance, and which is of concern as behind-the-scene requests are not fed to uBO's filtering engine by default.
A per-site switch in uBO to disable/enable CSP reporting on a per-site basis would address the issue of "disable reporting with some reasonable amount of granularity".
For the time being, I wouldn't want to add yet-another per-site switch in the popup panel, as its purpose and the rationale might be more difficult to understand for majority of users.
However, I will make the option to globally disable CSP reporting in the Settings panel along with other per-site switches -- with the usual link to the wiki explaining why one might one to globally disable CSP reporting. So any user would be able to easily disable/enable CSP reporting globally, and more advanced users could create more granular rules directly in the My rules pane.
Ideally, I want this new per-site switch to be released at the same time as fix to #3140.