Content Security Policy restrictions prevent injections

[ghost]

The title explains it all. I'm using Firefox 44.0.1 x64 on Ubuntu.

[Synzvato]

Hi @beardog108, thanks for sharing your findings.

This is indeed true, and a fix is underway. As a first step, the plan is to automatically identify domains that run strict policies, and then treat any of its required resources as missing.

There is an active prototype that internally marks domains tainted if the DOM node responsible for the request has a crossorigin or an integrity attribute, or if it's inside of an iframe.

It might also be an idea to try and make the add-on detect CSP errors caused by injected resources and mark the corresponding domain as tainted, which has not yet been prototyped.

This should give the project some breathing-space, as very little domains are currently affected by such policies. Any ideas or suggestions (in the form of comments, or Pull Requests) are welcome.

I'll tag this as a duplicate of #16 to keep the discussion in one place.

Thanks again for contributing, much appreciated!

[Synzvato]

@beardog108 I've decided to create a bug (1419459) on Mozilla's bugtracker. Upvotes are welcome.