Re: CSP and PostMessage?

Is data exfiltration still a concern for CSP?

If not, then why xhr-src is there?

I'm not sure about this, but it kinda makes sense...
On Dec 19, 2011 2:45 AM, "gaz Heyes" <gazheyes@gmail.com> wrote:

> On 19 December 2011 06:01, Daniel Veditz <dveditz@mozilla.com> wrote:
>
>> On 12/15/11 3:05 PM, Devdatta Akhawe wrote:
>> > Has a post-message-src directive being considered? From the
>> > introduction in the specification:
>>
>> I don't recall any discussions about it. Since postMessage() can
>> already be used safely I'm not feeling a burning need for it, but
>> maybe you can convince us.
>>
>
> There is no way to prevent an outgoing request, you can check the incoming
> request and ensure it was from the domain you intended but an attacker
> controlled postMessage request can be sent to any external domain so I
> think it would be useful to have control over it in CSP.
>