BackgroundIframeJs violating CSP
Open
- Dominant language
- HTML
- Stars
- 172
- Forks
- 180
- PR merge metrics
- No merged PRs in 30d
Description
I am attempting to implement a CSP, using self, some domains, some hashes as well as a nonce.
My CSP is flagging script-src-elem when attempting to run line 75 of BackgroundIframe.js. I believe that it is because the iframe src property is being set to javascript:"".
Removing the explicit setting of the src to javascript:'' solves the issue.
Contributor guide
Assessment
This issue has not been assessed yet.