Re: Strict mixed content checking (was Re: MIX: Exiting last call?)

> I guess that would be implied by the iframe sandbox attribute which would
>> be included-by-reference into CSP's sandbox directive.  It just seems ugly
>> that you'd have to set a sandbox and christmas-tree the flags to get this
>> behavior.  It also seems a bit out-of-pattern to add new flags to
>> sandboxing in this way.  All the other flags loosen the sandbox.
> I don't understand your point here. :/

(sorry, slang decoder here: )

If the strict checking for descendants is the only behavior you want, you
have to set sandbox on yourself, then opt-out of everything AND opt-in to
this new flag.


Received on Monday, 15 December 2014 19:39:47 UTC