{"action":"created","issue":{"url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/issues/447","labels_url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/issues/447/labels{/name}","comments_url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/issues/447/comments","events_url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/issues/447/events","html_url":"https://github.com/RequestPolicyContinued/requestpolicy/issues/447","id":40705026,"number":447,"title":"solve URI scheme problems","user":{"login":"myrdd","id":4286829,"avatar_url":"https://avatars.githubusercontent.com/u/4286829?v=3","gravatar_id":"","url":"https://api.github.com/users/myrdd","html_url":"https://github.com/myrdd","followers_url":"https://api.github.com/users/myrdd/followers","following_url":"https://api.github.com/users/myrdd/following{/other_user}","gists_url":"https://api.github.com/users/myrdd/gists{/gist_id}","starred_url":"https://api.github.com/users/myrdd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myrdd/subscriptions","organizations_url":"https://api.github.com/users/myrdd/orgs","repos_url":"https://api.github.com/users/myrdd/repos","events_url":"https://api.github.com/users/myrdd/events{/privacy}","received_events_url":"https://api.github.com/users/myrdd/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/labels/important","name":"important","color":"000000"}],"state":"open","locked":false,"assignee":{"login":"myrdd","id":4286829,"avatar_url":"https://avatars.githubusercontent.com/u/4286829?v=3","gravatar_id":"","url":"https://api.github.com/users/myrdd","html_url":"https://github.com/myrdd","followers_url":"https://api.github.com/users/myrdd/followers","following_url":"https://api.github.com/users/myrdd/following{/other_user}","gists_url":"https://api.github.com/users/myrdd/gists{/gist_id}","starred_url":"https://api.github.com/users/myrdd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myrdd/subscriptions","organizations_url":"https://api.github.com/users/myrdd/orgs","repos_url":"https://api.github.com/users/myrdd/repos","events_url":"https://api.github.com/users/myrdd/events{/privacy}","received_events_url":"https://api.github.com/users/myrdd/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/milestones/9","html_url":"https://github.com/RequestPolicyContinued/requestpolicy/milestones/1.0.beta11","labels_url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/milestones/9/labels","id":872403,"number":9,"title":"1.0.beta11","description":"","creator":{"login":"myrdd","id":4286829,"avatar_url":"https://avatars.githubusercontent.com/u/4286829?v=3","gravatar_id":"","url":"https://api.github.com/users/myrdd","html_url":"https://github.com/myrdd","followers_url":"https://api.github.com/users/myrdd/followers","following_url":"https://api.github.com/users/myrdd/following{/other_user}","gists_url":"https://api.github.com/users/myrdd/gists{/gist_id}","starred_url":"https://api.github.com/users/myrdd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myrdd/subscriptions","organizations_url":"https://api.github.com/users/myrdd/orgs","repos_url":"https://api.github.com/users/myrdd/repos","events_url":"https://api.github.com/users/myrdd/events{/privacy}","received_events_url":"https://api.github.com/users/myrdd/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":0,"state":"open","created_at":"2014-11-19T07:04:40Z","updated_at":"2015-03-19T09:59:22Z","due_on":null,"closed_at":null},"comments":40,"created_at":"2014-08-20T14:39:24Z","updated_at":"2015-03-22T18:23:43Z","closed_at":null,"body":"At the moment, RequestPolicy is designed to deal with Domain Names ([wikipedia](https://en.wikipedia.org/wiki/Domain_name)). But in fact RP has to deal with any kind of URI, and its syntax (see [wikipedia](https://en.wikipedia.org/wiki/URI_scheme#Generic_syntax)) allows quite a lot.\r\n\r\nOne important part of the URI is the *scheme*; common examples are `http`, `https` and `ftp`, but it includes also `about`, `mailto`, `view-source` and many others. In fact, it could be any arbitrary string, like `UT2004` for example (see #412).\r\n\r\nAs there are infinite possibilities for *URI schemes*, I'd like to generally block unknown schemes, but give the user the possibility to whitelist them. RP already has some hardcoded scheme rules (e.g. in `shouldLoad`) – the user will have the ability to extend them.\r\n\r\nBut, we have to keep one fact in mind: there are several non-http schemes which contain an *http URI* as its *path* (!).\r\nExample: `view-source:https://github.com` – `view-source` is the *scheme*, `https://github.com` is the *path* – this is how the specification is.\r\nIn that case, we want to extract the \"real URL\" and check if this one is ok or should be rejected.\r\n\r\n**My proposal** is to have several *scheme lists*:\r\n- `normal:` URIs with such schemes are processed as always\r\n- `recursive:` URIs with that scheme will be checked for \"child\" URIs\r\n- `whitelist:` requests with *destination* URIs with such a scheme are allowed directly\r\nThe user may add schemes to the whitelist only.\r\nRequests to unknown schemes will be blocked in general. (user will be informed)\r\n\r\n**Example schemes:**\r\n- `normal:` http, https, ftp\r\n- `recursive:` view-source (already implemented (hardcoded))\r\n- `whitelist:` {resource, about, data, chrome, moz-icon, moz-filedata, blob, wyciwyg, javascript} (see `RequestPolicyService.prototype._isInternalRequest`)\r\n\r\n**Known schemes:** (list partly taken from [here](https://github.com/RequestPolicyContinued/requestpolicy/issues/410#issuecomment-52673007))\r\n * `about` – https://github.com/RequestPolicyContinued/requestpolicy/issues/131, https://github.com/RequestPolicyContinued/requestpolicy/issues/377, https://github.com/RequestPolicyContinued/requestpolicy/issues/399, https://github.com/RequestPolicyContinued/requestpolicy/issues/426, (https://github.com/RequestPolicyContinued/requestpolicy/issues/427) – see also [mozillazine](http://kb.mozillazine.org/About_protocol_links) and the `about:about` page\r\n * `chrome-extension` (#571)\r\n * `feed` – #395, #313, #386, #372\r\n * `gopher` (#311)\r\n * `jar` – https://github.com/RequestPolicyContinued/requestpolicy/issues/409\r\n * `magnet` – #410\r\n * `mailto` – #362\r\n * `mediasource` – #512, RequestPolicy#448 –  ~~(or [blob](http://www.w3.org/TR/FileAPI/#url)?)~~ for [Media Source Extensions](https://dvcs.w3.org/hg/html-media/raw-file/tip/media-source/media-source.html)\r\n * `mediastream`\r\n * `nxm`\r\n * `spotify` (#296)\r\n * `UT2004` (#412)"},"comment":{"url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/issues/comments/84670159","html_url":"https://github.com/RequestPolicyContinued/requestpolicy/issues/447#issuecomment-84670159","issue_url":"https://api.github.com/repos/RequestPolicyContinued/requestpolicy/issues/447","id":84670159,"user":{"login":"cm-mc","id":11512937,"avatar_url":"https://avatars.githubusercontent.com/u/11512937?v=3","gravatar_id":"","url":"https://api.github.com/users/cm-mc","html_url":"https://github.com/cm-mc","followers_url":"https://api.github.com/users/cm-mc/followers","following_url":"https://api.github.com/users/cm-mc/following{/other_user}","gists_url":"https://api.github.com/users/cm-mc/gists{/gist_id}","starred_url":"https://api.github.com/users/cm-mc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cm-mc/subscriptions","organizations_url":"https://api.github.com/users/cm-mc/orgs","repos_url":"https://api.github.com/users/cm-mc/repos","events_url":"https://api.github.com/users/cm-mc/events{/privacy}","received_events_url":"https://api.github.com/users/cm-mc/received_events","type":"User","site_admin":false},"created_at":"2015-03-22T18:23:43Z","updated_at":"2015-03-22T18:23:43Z","body":"The link above is dead (https://github.com/RequestPolicyContinued/requestpolicy/tree/dev-restartless-and-e10s)."}}