RFC: Add limited support for JS bricks

[twschiller]

Context

• Providing support for a JS brick would provide an alternative to jq that developers are more familiar with
• MV3 bans remote code. "Remotely hosted code is no longer allowed"
• However, MV3 also includes a new scripting API: https://developer.chrome.com/docs/extensions/reference/scripting/

Related Browser Vendor Issues:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1687761

Related w3c Issues:

• Do not outlaw dynamic code w3c/webextensions#139

Related PixieBrix Issues:

• Identify gaps preventing migration to Chrome Manifest V3 #287
• Move template engine and brick evaluation to Chrome sandbox #105

[fregante]

The scripting API is mostly equivalent to the current Tabs API for executing scripts, it still does not allow remote scripts nor userscripts yet. I think it will be a bit difficult to pass review should it ever get flagged.

My guess is that if they were to add support for userscripts, they would have to be provided by the user explicitly rather than loaded from a server wrapped in additional logic (i.e. bricks and blueprints)

I have never submitted an extension with the “remote code” capability, but as far as I know you have to specify that the extension does that in the CWS admin area. That alone will likely trigger a manual review, even in MV2

[twschiller]

My guess is that if they were to add support for userscripts, they would have to be provided by the user explicitly rather than loaded from a server wrapped in additional logic (i.e. bricks and blueprints)

I think that's probably right. The grey area is in how much "help" the user gets to provide the logic

So far we have not had to indicate we include remote code and have never been flagged for it (with 1yr+ of submitting to CWS). Not sure if the MV3 review process will flag it. We'll probably need to submit an MV3 version at some point to find out. There are still some MV3 gaps I've been waiting for them to address though