Re: Unofficial Draft of Content Security Policy

On 03/03/2011 02:37 PM, gaz Heyes wrote:
> Nice work
> 
> But.... I see that img-src is defined and font-src but every url() based
> CSS method is missing, then you've got HTML attributes like background.
> How do you control those? Are they same domain by default?

Good catch.  No, you are right, all image loads that happen via CSS are
also subject to img-src.  I'll make sure to include that in the next
revision.

Thanks,
Brandon