Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code

Unified Diff: lib/csp.js

Issue 29377728: Issue 4866 - Add the child-src CSP directive back again for now (Closed)
Patch Set: Keep frame-src too, just in case Created March 1, 2017, 2:38 p.m.
Use n/p to move between diff chunks; N/P to move between comments.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: lib/csp.js
diff --git a/lib/csp.js b/lib/csp.js
index b1241a1873626aa212f6223969e574f2c4807c8b..d4e8ac3b7cdb7b1bc3163601adb45dc3afcfc9c3 100644
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -38,9 +38,12 @@ chrome.webRequest.onHeadersReceived.addListener(details =>
// not inherited from the parent for documents with data: and blob: URLs.
// https://bugs.chromium.org/p/chromium/issues/detail?id=513860
//
+ // We must use the deprecated child-src directive instead of worker-src
+ // since that's not supported yet (as of Chrome 56.)
+ //
// "http:" also includes "https:" implictly.
// https://www.chromestatus.com/feature/6653486812889088
- value: "connect-src http:; frame-src http:; object-src http:"
+ value: "connect-src http:; child-src http:; frame-src http:; object-src http:"
});
return {responseHeaders: details.responseHeaders};
}
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld