i am trying to make this work with manifest v3 , i am aware that this… - #50
Open
o7528328-arch wants to merge 1 commit into
Open
i am trying to make this work with manifest v3 , i am aware that this…#50o7528328-arch wants to merge 1 commit into
o7528328-arch wants to merge 1 commit into
Conversation
… is shit put it works
momenbasel
added a commit
to momenbasel/new-google-unlocked
that referenced
this pull request
May 27, 2026
…I-free mode Adds several things on top of the MV3 conversion that match the spirit of the extension (surfacing content Google hides). All changes are content-script / DNR only - no new dangerous permissions. XSS fix (forwards-port of upstream PR Ibit-to#4 to current u.js): - Lumen-derived strings are now HTML-escaped before being inserted into the result panel. The previous code interpolated the regex capture directly into the href and link text, which lets a maliciously crafted Lumen notice break out of the href attribute (the capture class `[^\s-<]+` does NOT exclude `"`, `>` or `&`). SERP unlock (auto, once per query, with sentinel to avoid loops): - filter=0 -> show "omitted similar" results Google hides by default - pws=0 -> disable personalized results - nfpr=1 -> disable Google's "did you mean / search instead for" silent query rewrite A `gu_unlocked=1` tombstone is appended so the redirect happens at most once per navigation - the user can still remove any param manually and we won't re-add it. "Web only" toggle: - Injects a small pill into the SERP nav linking to the same query with udm=14, which is Google's plain-web mode (no AI Overview, no SGE, no Discover-style cards). One-click escape hatch. Archive fallbacks in the unlocked panel: - Each revealed domain now also exposes [Wayback] and [archive.ph] links so the user can read the takendown page even if it is gone from the live web. This is the actual end-user value of knowing what was removed. Legacy chillingeffects.org support (idea from PR Ibit-to#50): - Old Google takedown footers sometimes still link to chillingeffects.org/notice.cgi (Lumen's previous name). u.js now also matches those, and a second DNR rule plus host_permissions entry lets the cross-origin XHR through. CORS preflight hardening (idea from PR Ibit-to#49): - DNR rules also set Access-Control-Allow-Methods: GET, OPTIONS so if the browser ever issues a preflight for these requests (e.g. if a future jQuery sends a custom header) it does not fail. version 2.0 -> 2.1
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
… is shit put it works