[Bug 25566] New: [imports]: Supporting more than just the script-src CSP directive in imports.

https://www.w3.org/Bugs/Public/show_bug.cgi?id=25566

            Bug ID: 25566
           Summary: [imports]: Supporting more than just the script-src
                    CSP directive in imports.
           Product: WebAppsWG
           Version: unspecified
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: DOM
          Assignee: [email protected]
          Reporter: [email protected]
        QA Contact: [email protected]
                CC: [email protected], [email protected]
            Blocks: 20683

The Content Security Policy section of HTML Imports currently specifies:
"Content Security Policy must restrict import loading through the script-src
directive."

There seems to be a slight mismatch between the CSP directives and what HTML
Imports supports. For example, I can imagine html imports being used for just
html+css, or just svg without script.

I don't have a great suggestion for how to support this other than additional
import types such as "import-src". Doing this would require spec'ing how the
transitive CSP dependencies of imports works.

-- 
You are receiving this mail because:
You are on the CC list for the bug.