3 ms·
It's unfortunate that the author doesn't appear to understand the value of a strict Content-Security-Policy.
by lol768 7y ago
It's unfortunate that the author doesn't appear to understand the value of a strict Content-Security-Policy.
- lol768 7y agoFor context, see this GitHub issue: https://github.com/codemirror/CodeMirror/issues/4937 https://github.com/codemirror/CodeMirror/issues/4937 Author is unwilling to change a handful lines of code to make the package compatible with a strict style-src. Why does this matter? You can exfiltrate data such as CSRF tokens using inline styles from a HTML injection vulnerability: https://medium.com/bugbountywriteup/exfiltration-via-css-injection-4e999f63097d https://medium.com/bugbountywriteup/exfiltration-via-css-inj...