Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce $permissions modifier description #40

Merged
merged 8 commits into from
Jan 31, 2023
Merged
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions docs/general/ad-filtering/create-own-filters.md
Original file line number Diff line number Diff line change
Expand Up @@ -756,6 +756,41 @@ For the requests matching a `$csp` rule, we will strengthen response security po
>
> Rules with `$csp` modifier are not supported by AdGuard Content Blocker, AdGuard for iOS and Safari.

#### **`$permissions`** {#permissions-modifier}

This modifier completely changes the rule behavior. If it is applied to a rule, it will not block the matching request. The response headers are going to be modified instead.

> In order to use this type of rules, it is required to have the basic understanding of the [Feature Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Feature_Policy) security layer.

For the requests matching a `$permissions` rule, AdGuard strengthens response's feature policy by adding additional feature policy equal to the `$permissions` modifier contents. `$permissions` rules are applied independently from any other rule type. Other basic rules have no influence on it **save for document-level exceptions** (see the examples section).

> **Multiple rules matching a single request.**
>
> In case if multiple `$permissions` rules match a single request, AdGuard will apply each of them.

**Syntax**

`$permissions` value syntax is similar to the `Permissions-Policy` (or `Feature-Policy`) header syntax.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need a list of permissions here (at least the most prominent ones + a link to the full list)

Copy link
Contributor Author

@sxgunchenko sxgunchenko Jan 24, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some more links. Not sure about the most prominent ones as most of them are still experimental. And besides, I suppose the list is still subject to change.


`$permissions` value can be empty in the case of exception rules. See examples section for further information.
sxgunchenko marked this conversation as resolved.
Show resolved Hide resolved

> **Limitations**
>
> 1. Please note that there are a few characters forbidden in the `$permissions` value: `,`, `$`;
sxgunchenko marked this conversation as resolved.
Show resolved Hide resolved
> 2. `$permissions` is compatible with the limited list of modifiers: `$domain`, `$important`, `$subdocument`.
sxgunchenko marked this conversation as resolved.
Show resolved Hide resolved

**Examples**

* `||example.org^$permissions=sync-xhr 'none'` disallows synchronous `XMLHttpRequest` requests across `example.org`.
* `@@||example.org/page/*$permissions=sync-xhr 'none'` disables all rules with the `$permissions` modifier exactly matching `sync-xhr 'none'` on all the pages matching the rule pattern. For instance, the rule above.
* `@@||example.org/page/*$permissions` disables all the `$permissions` rules on all the pages matching the rule pattern.
* `$domain=example.org|example.com,permission=oversized-images 'none'; sync-script 'none'; unsized-media 'none';` disallows oversized images, synchronous scripts and unsized media features across `example.org` and `example.com`.
* `@@||example.org^$document` or `@@||example.org^$urlblock` disables all the `$permission` rules on all the pages matching the rule pattern.

> **Compatibility with different versions of AdGuard**
>
> Rules with the `$permissions` modifier are supported by AdGuard for Windows, Mac, and Android, **running CoreLibs version 1.11 or later**.

##### **`$all`**

`$all` modifier is made of [`$document`](#document-modifier), [`$popup`](#popup-modifier), [`$csp`](#csp-modifier) modifiers. E.g. rule `||example.org^$all` is converting into such set of rules:
Expand Down