Re: Firefox17 and CSP - inline broken?

Nvm found

https://bugzilla.mozilla.org/show_bug.cgi?id=783049

&

https://bugzilla.mozilla.org/show_bug.cgi?id=746978

From: <sec_ext@fb.com<mailto:sec_ext@fb.com>>
Date: Wednesday, December 5, 2012 4:12 PM
To: "public-webappsec@w3.org<mailto:public-webappsec@w3.org>" <public-webappsec@w3.org<mailto:public-webappsec@w3.org>>
Subject: Firefox17 and CSP - inline broken?
Resent-From: <public-webappsec@w3.org<mailto:public-webappsec@w3.org>>
Resent-Date: Wednesday, December 5, 2012 4:13 PM

We noticed CSP parsing changed in Firefox17 (our header stopped working) and we saw https://bugzilla.mozilla.org/show_bug.cgi?id=737064

Any attempts at allowing inline scripts does not work for us.

Anyone else having this issue?

Example that's failing and resulting in 'CSP WARN: Directive inline script base restriction violated' console errors:

x-content-security-policy: default-src *;script-src https://*.facebook.com http://*.facebook.com 'unsafe-inline' 'unsafe-eval'

Thanks