Yeah as people mentioned since I wrote about it back in Jan http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html http://homakov.blogs

Yeah as people mentioned since I wrote about it back in Jan http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html http://homakov.blogspot.com/2014/01/using-content-security-p... there was a massive discussion how to mitigate it. They decided to allow paths which come as result of 302 redirect. Good enough. Dude don't kill this bug, this is only reliable detection to use in other exploits