- From: Antonio Sartori <notifications@github.com>
- Date: Mon, 13 Feb 2023 03:47:00 -0800
- To: w3c/FileAPI <FileAPI@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Monday, 13 February 2023 11:47:12 UTC
Yes. I think this makes things possible that were not possible before. For example, a page with `default-src blob:` should not be able to exfiltrate any information at the moment. After this proposal, it will be able via a cross-origin blob. I am reading https://github.com/shhnjk/Safe-Blob-URL#is-there-a-way-to-block-cross-origin-blob-urls-in-iframe and I think it would be better if `blob:` in CSP does **not** allow cross-origin blobs, and instead a new keyword is needed for allowing framing them. -- Reply to this email directly or view it on GitHub: https://github.com/w3c/FileAPI/issues/192#issuecomment-1427805863 You are receiving this because you are subscribed to this thread. Message ID: <w3c/FileAPI/issues/192/1427805863@github.com>
Received on Monday, 13 February 2023 11:47:12 UTC