Re: [filter-effects][css-masking] Move security model for resources to CSP

On Fri, Apr 5, 2013 at 1:02 PM, Mike West <mkwst@google.com> wrote:
> I'd agree. It does seem, however, that these should also be subject to CSP
> restrictions, above and beyond the target origin enabling access via CORS.
>
> Does tying the resource loads to the 'style-src' directive make sense?

Anything fetched via url() should be subject to that already I think.
Not entirely sure about SVG xlink:href pointers. I suspect treating
most of those as style-src makes sense, but not e.g. <svg:script
xlink:href>...


--
http://annevankesteren.nl/

Received on Friday, 5 April 2013 18:42:43 UTC