Unified Diff: lib/csp.js
Issue 29377728:
Issue 4866 - Add the child-src CSP directive back again for now (Closed)
Patch Set: Keep frame-src too, just in case
Created March 1, 2017, 2:38 p.m.
Use n/p to move between diff chunks;
N/P to move between comments.
« no previous file with comments
|
« no previous file
|
no next file »
|
no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')
| Index: lib/csp.js |
| diff --git a/lib/csp.js b/lib/csp.js |
| index b1241a1873626aa212f6223969e574f2c4807c8b..d4e8ac3b7cdb7b1bc3163601adb45dc3afcfc9c3 100644 |
| --- a/lib/csp.js |
| +++ b/lib/csp.js |
| @@ -38,9 +38,12 @@ chrome.webRequest.onHeadersReceived.addListener(details => |
| // not inherited from the parent for documents with data: and blob: URLs. |
| // https://bugs.chromium.org/p/chromium/issues/detail?id=513860 |
| // |
| + // We must use the deprecated child-src directive instead of worker-src |
| + // since that's not supported yet (as of Chrome 56.) |
| + // |
| // "http:" also includes "https:" implictly. |
| // https://www.chromestatus.com/feature/6653486812889088 |
| - value: "connect-src http:; frame-src http:; object-src http:" |
| + value: "connect-src http:; child-src http:; frame-src http:; object-src http:" |
| }); |
| return {responseHeaders: details.responseHeaders}; |
| } |
« no previous file with comments
|
« no previous file
|
no next file »
|
no next file with comments »
