On Tue, Apr 7, 2015 at 5:43 PM, Dimitri Glazkov <dglazkov@google.com> wrote: > On Tue, Apr 7, 2015 at 1:39 PM, Mike West <mkwst@google.com> wrote: >> >>> After thinking about this a bit more over the holidays, I think I'm more >>> in agreement with you than I thought, Dev. :) >>> >>> What do you think about this: >>> >>> 1. Move imports to `import-src` (we'll need to measure usage in Chrome, >>> but assuming this is mostly an extension thing at this point, it should be >>> doable). >>> >>> 2. Give imports their own policy (that is, no longer inherit from the >>> containing document) like Workers and frames, which would enable them to >>> either whitelist `unsafe-inline` themselves, or use nonces/hashes whatever. >>> >> > This seems encouraging. What is the bottom line for developers using CSP? > What is the least that they need to do in order to make HTML Imports usable? > The very least? Nothing at all. No CSP, no problem, right? The least they should do to maintain the security invariants they had before is add an `imports-src` directive to their policy that allows Imports from a set of sources. We'd almost certainly want to change Chrome extension/app's default CSP to include such a directive. Maybe `import-src` would even default to `script-src`, in the same way (the deprecated) `frame-src` defaults to `child-src` (which defaults to `default-src`)? We've avoided these chains in the past, but it might make sense here, as Imports can and do execute script, and the vast majority of sites wouldn't know that they should think about restricting them. -mike -- Mike West <mkwst@google.com>, @mikewest Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth Flores (Sorry; I'm legally required to add this exciting detail to emails. Bleh.)
Received on Tuesday, 7 April 2015 16:53:53 UTC