An important component of NoScript, preventing "untrusted" sites from abusing "trusted" ones to execute scripts through reflective XSS, is its anti-XSS filter called "InjectionChecker".

This InjectionChecker doesn't scan just the URL, but also form data extracted from POST payloads, looking for suspect HTML/JavaScript patterns which may be reflected by the requested page in a cross-site scripting attack.

Furthermore, pattern matching happens on several transformations of URL / POST payload fragments (e.g. base64 decoding, entity unescaping, decodeURIComponent() and others which may be applied by the victim website before reflection).

This complex and potentially CPU intensive (depending on the actual payload) task is currently performed in a WebWorker called from an asynchronous blocking webRequest.onBeforeRequest listener.

The declarativeNetRequest API is currently useless for this use case, not supporting POST content processing nor transformation before pattern matching.

For these reasons, NoScript's XSS filter (and any use case requiring POST payload processing, like the SitePolicy or ABE) at this moment have a future only on Firefox, which is committed to keep (asynchronous) blocking webRequest.

Are there any suggested alternatives, or ways to modify DNR in a suitable way, in order to support this use case on Chromium/MV3?