Content Security Policy for P2 embedded content

[systemed]

Opening P2 in Safari 12 currently borks with these errors in the console:

[Error] Refused to connect to https://osmlab.github.io/crossdomain.xml because it does not appear in the connect-src directive of the Content Security Policy.
[Error] Failed to load resource: Blocked by Content Security Policy. (crossdomain.xml, line 0)
[Error] Refused to connect to https://gravitystorm.dev.openstreetmap.org/cnxc-snapshot/crossdomain.xml because it does not appear in the connect-src directive of the Content Security Policy.
[Error] Failed to load resource: Blocked by Content Security Policy. (crossdomain.xml, line 0)
[Error] Refused to connect to https://fpdownload.adobe.com/pub/swz/crossdomain.xml because it does not appear in the connect-src directive of the Content Security Policy.
[Error] Failed to load resource: Blocked by Content Security Policy. (crossdomain.xml, line 0)
[Error] Refused to connect to https://fpdownload.adobe.com/pub/swz/crossdomain.xml because it does not appear in the connect-src directive of the Content Security Policy.
[Error] Failed to load resource: Blocked by Content Security Policy. (crossdomain.xml, line 0)

gravitystorm.dev.openstreetmap.org/cnxc-snapshot/ is currently erroring anyway (and fairly ancient history) so I should probably remove it, but the others are more important, particularly the imagery index. Is this something that could be added to the CSP for osm.org?

[tomhughes]

I suspect this is Safari being weird/different because it works fine in Firefox.

I think that in Firefox everything flash does is matched against the object_src rule because it doesn't really know what a plugin is planning to use the resource for but maybe Safari is matching against connect_src instead?

[systemed]

It's fine in Safari 10 too (and I think it was in 11, but don't recall). I haven't found any relevant, Flash-specific bug reports for Safari 12.

[tomhughes]

Confirmed that firefox is matching that against object_src as a I get the same errors if I restrict that.

[tomhughes]

By the way lots of the imagery is trying to load over http and being rejected because Firefox can't tell it's passive so treats it all as active and blocks it.