Re: [webappsec] CSP: are blob uri's really just origin='self'?

More evidence of the problem. Unless we restrict "*" to mean "same
scheme" or "http/https only" we're going to keep adding exceptions and
getting bit when people invent new schemes. Keep it simple for web
developers:
  - CSP is an HTTP header, "*" means HTTP(s) things
  - anything else must be explicit

-Dan Veditz

On 9/3/2013 1:48 PM, Devdatta Akhawe wrote:
> Should we add filesystem: URIs to that list? I think there was a claimed
> Chrome extensions' CSP bypass due to filesystem: URIs at this year's
> AppSecEU: http://is.gd/mq1GLQ
> 
> -dev
> 
> On 3 September 2013 13:38, Brad Hill <hillbrad@gmail.com
> <mailto:hillbrad@gmail.com>> wrote:
> 
>     We had an action item for some time to clarify this, that we
>     dropped.  I'd propose something like the following: