Eli Grey

triggerMap iteration is broken when Array.prototype is polluted

1

https://github.com/ghosh/Micromodal/issues/269 is not fixed. Please see [this comment](https://github.com/ghosh/Micromodal/issues/269#issuecomment-605404512). Some advertising scripts pollute `Array.prototype` (e.g. `Array.prototype.clear`), which is iterated by micromodal in these two locations and ends up attempting to iterate...

Store bridge address protocol

3

I didn't look at your code closely enough to see where I need to put 'upgrade' code for data stored in the old format. Do you mind doing that part...

This will make `eval(document.write.START)` and `eval(document.write.END)` unnecessary. If the context is an async script element without an src containing text, add in text and run `script.parentNode.replaceChild(document.importNode(script, true), script)`. I will...

Update: async.js has been deprecated by native promises syntax I need to improve the error system so that null can be an allowed return value of async functions. I think...

Public Suffix API

14

I propose that eTLD+1 should be exposed to web content through `location‍.site` and `new URL('…').site`. Webapps shouldn't have to embed the Public Suffix List (currently 222KB!) to lookup eTLD+1 when...

Use `Navigator.prototype` for DNT & GPC signal injectors

4

This fixes #2788. This is currently untested until I try out your build process.

GPC & DNT signal injector does not follow spec

6

Your [Global Privacy Control / Do-Not-Track signal injector](https://github.com/EFForg/privacybadger/blob/d854233680592143cbf2bfc2c8da8bf9bf167ed5/src/js/contentscripts/dnt.js#L25-L44) does not follow the GPC or DNT specs. This is supposed to be exposed through getters on `Navigator.prototype`, not literal values set...

Domain misclassification: transcend.io

4

### Description You recently classified all of `transcend.io` as a tracker. None of our first-party client-side tools (e.g. Transcend Consent Manager) or SaaS products (e.g. Transcend Privacy Requests) are used...

Consent-O-Matic does not spoof trusted clicks

2

Your click mechanism does not spoof `event.isTrusted` (e.g. see ). Due to this current limitation, your extension is unable to automate setting consent preferences for Transcend Consent Manager, which requires...

When SharedArrayBuffer is available, benchmark.js should attempt to use SAB-based high resolution timers.