Re: CSP & data URIs

OK, my mistake.
In that case, I understand that enabling "img-src data:" in CSP can be
recommended as part of a Web performance best practice.


On Thu, Jan 10, 2013 at 4:02 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:

> On 1/10/13 9:44 AM, Yoav Weiss wrote:
>
>> It seems that at least in some browsers, img data URIs are XSS
>> exploitable[1][2].
>>
>
> Uh.... no.  They're not.  What made you think they are, exactly?  The
> links you point to certainly say nothing of the sort.
>
> -Boris
>
>