Security issue
charles30l opened this issue · 0 comments
charles30l commented
If you remove the plugin from a document through google's interface (uncheck it), the plugin does not remove its permissions on said document. You can still run it on the doc until you completely uninstall the add-on from the account.
Basically, once you add the plugin to a doc, it is always there. No screenshots because my company cares about this, and had to forcibly remove it from the doc I was working on.
Easy to reproduce though:
- Install add-on to account
- In a google doc go to manage add-ons
- add it to doc
- format something as intended
- go back to manage add-ons
- uncheck it
No matter what you do from here it will always be able to run on this document until removed from the account entirely.