4 ms·
It's rather an origin check instead of CSP I believe [1], and I can imagine a lot of possible attacks if it's open wide... [1] https://drafts.csswg.org/cssom/#
by lifthrasiir 3y ago
It's rather an origin check instead of CSP I believe [1], and I can imagine a lot of possible attacks if it's open wide...
[1] https://drafts.csswg.org/cssom/#concept-css-style-sheet-origin-clean-flag https://drafts.csswg.org/cssom/#concept-css-style-sheet-orig...
- cxr 3y agoTo be clear: I wasn't saying that restricted cross-origin access to style rules was a consequence of CSP; I was likening the effects of document.styleSheets restrictions to the effects of CSP restrictions. (It happens that CSP has other, worse effects.)