W3C home > Mailing lists > Public > public-web-security@w3.org > December 2011

Re: Proposed directive for CSP.next: "no-user-js"

From: Brandon Sterne <bsterne@mozilla.com>
Date: Wed, 14 Dec 2011 14:32:15 -0800 (PST)
To: Boris Zbarsky <bzbarsky@MIT.EDU>
Cc: public-web-security@w3.org
Message-ID: <320887901.37653.1323901935653.JavaMail.root@zimbra1.shared.sjc1.mozilla.com>
> From: "Boris Zbarsky" <bzbarsky@MIT.EDU>
> To: public-web-security@w3.org
> Sent: Wednesday, December 14, 2011 2:12:20 PM
> Subject: Re: Proposed directive for CSP.next: "no-user-js"
> 
> Would this affect developer tools?

Yes it would, and an implementation detail that I left out of the proposal would be that we'd probably add a pref to disable this restriction for power users who want to turn off the safety catch.

> Would this affect something like Greasemonkey?

I would argue that it should not affect Greasemonkey for the same reasons that I gave for not applying the restriction to javascript: bookmarks.  I can be persuaded here, though.  It's definitely a grey area.

-Brandon

> -Boris
Received on Wednesday, 14 December 2011 22:32:43 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Wednesday, 14 December 2011 22:32:46 GMT