W3C home > Mailing lists > Public > public-webappsec@w3.org > April 2013

Re: [webappsec] CSP 1.0 bug? button type=image and img-src

From: Adam Barth <w3c@adambarth.com>
Date: Wed, 24 Apr 2013 08:29:37 -0700
Message-ID: <CAJE5ia-Mbr6et3Ka-9fJ9nWmf-86PmjPA2NWEh24daNjeq=Bwg@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: "Hill, Brad" <bhill@paypal-inc.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>
On Wed, Apr 24, 2013 at 3:28 AM, Anne van Kesteren <annevk@annevk.nl> wrote:
> On Tue, Apr 23, 2013 at 11:04 PM, Adam Barth <w3c@adambarth.com> wrote:
> > We should try to find a way editorially to avoid having to enumerate all the
> > different ways user agents can load images.  We're unlikely to be able to
> > list them all, and it will make the spec fragile as the platform evolves.
> Should we make these "types" (media, image, etc.) part of what
> specifications define when they perform a
> http://fetch.spec.whatwg.org/ ? That way we have a nice way to hook in
> the CSP check there.

That sounds like a good idea.

Received on Wednesday, 24 April 2013 15:30:39 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:32 UTC