Fix potential exfiltration of browsing history by a rogue list author…

… through permissions=

As with `csp=` option, reporting capabilities need to be taken
into account with `permissions=` option.

Reference:
https://github.com/w3c/webappsec-permissions-policy/blob/main/reporting.md

This commit ensures that `permissions=` option using `report-to` are
marked as invalid.

src/js/static-filtering-parser.js

@@ -897,6 +897,7 @@ export class AstFilterParser {
  this.rePatternScriptletJsonArgs = /^\{.*\}$/;
  this.reGoodRegexToken = /[^\x01%0-9A-Za-z][%0-9A-Za-z]{7,}|[^\x01%0-9A-Za-z][%0-9A-Za-z]{1,6}[^\x01%0-9A-Za-z]/;
  this.reBadCSP = /(?:^|;)\s*report-(?:to|uri)\b/i;
+ this.reBadPP = /(?:^|;)\s*report-to\b/i;
  this.reNoopOption = /^_+$/;
  this.scriptletArgListParser = new ArgListParser(',');
  }
@@ -1400,7 +1401,11 @@ export class AstFilterParser {
  realBad = this.isRegexPattern() === false;
  break;
  case NODE_TYPE_NET_OPTION_NAME_PERMISSIONS:
- realBad = modifierType !== 0 || (hasValue || isException) === false;
+ realBad = modifierType !== 0 ||
+ (hasValue || isException) === false ||
+ this.reBadPP.test(
+ this.getNetOptionValue(NODE_TYPE_NET_OPTION_NAME_PERMISSIONS)
+ );
  if ( realBad ) { break; }
  modifierType = type;
  break;