Re: Unofficial Draft of Content Security Policy

Nice work

But.... I see that img-src is defined and font-src but every url() based CSS
method is missing, then you've got HTML attributes like background. How do
you control those? Are they same domain by default?

On 3 March 2011 18:17, Brandon Sterne <bsterne@mozilla.com> wrote:

> Hello all,
>
> Apologies for the delays in getting this published.  You can find the
> first Unofficial Draft of the Content Security Policy specification here:
>
> https://dvcs.w3.org/hg/content-security-policy/raw-file/bcf1c45f312f/csp-unofficial-draft-20110303.html
>
> I hope you will find the new format well-organized and reflective of our
> discussion so far.  While this document will likely remain in Unofficial
> Draft status until we get our charter reviewed and accepted, in the
> meantime this it should provide a good basis for further discussions.  I
> look forward to receiving your feedback.
>
> Best,
> Brandon
>
>