Greaselion should provide an API for validating that message is from Greaselion

This issue came up during a security review for https://github.com/brave/brave-core/pull/5440.

Greaselion content scripts are currently downloaded on-the-fly and given a dynamically-generated extension ID when installed locally. The problem with this approach is that other extensions could send messages to Brave and the browser would have no way to authenticate that they were sent by Greaselion extensions.

One idea I can think of is to enhance the Greaselion.json file to support an id key, allowing content script creators to specify a static extension ID for Greaselion to use. The Greaselion service could then insert this id into the manifest when generating the given extension.

[bridiver]

So it seems like we may be able to get any APIs we want to run in content scripts instead of only background scripts by adding the content_script context to the relevant _api_features.json file, e.g. https://source.chromium.org/chromium/chromium/src/+/master:extensions/common/api/_api_features.json;l=517?q=_api_features.json.

However, I have to think there’s a reason chrome doesn’t do this, instead confining all browser APIs to the background process and only allowing message passing from the page content script thread. Given that, I have performance and security concerns around allowing our APIs from the content script (I assume it’s on the page process?), and would love it if someone more expert (@diracdeltas, @bridiver ?) could weigh in on that.

@petemill that would be an extremely bad idea and even if you added it to api_features, I’m pretty sure it still wouldn’t work correctly. The APIs that content scripts can access are intentionally limited for security reasons

[diracdeltas]

That sounds fine as long as all greaselion scripts are maintained by us.