[Bug 22752] [imports]: Imports should respect CSP

https://www.w3.org/Bugs/Public/show_bug.cgi?id=22752

--- Comment #2 from Morrita Hajime <morrita@google.com> ---
Noticed that it's hard to enforce non-eval() policy
because imports share its context with the master.

V8/Blink doesn't have mechanism to switch allow/disallow eval
per script evaluation. Also, it's hard to track the call site 
if we call eval in some callbacks.

In practice though, this won't be a problem because
apps/sites which want to prohibit eval() in imports will want to prohibit
eval()
in its own context. 

So question here is whether we should explicitly exclude eval() blocking
or leave it as an implementation limitation.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Friday, 26 July 2013 05:18:18 UTC