Skip to content

Issue with "CSP: script-src": (short summary here please) #5286

@jf

Description

@jf

MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src (and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src-elem)

What information was incorrect, unhelpful, or incomplete?

in both pages, the explanation for the 'unsafe-inline' source mentions "inline <style> elements". But given that these directives (script-src, and script-src-elem) are about specifying sources for JavaScript, surely this means that "inline <style> elements" are excluded?

Specific section or headline?

section explaining 'unsafe-inline'

What did you expect to see?

An explanation that is relevant to the directive, and that does not mention inline <style> elements at all.

ALSO:

  • is 'unsafe-inline' even valid for script-src-elem, given that "The HTTP Content-Security-Policy (CSP) script-src-elem directive specifies valid sources for JavaScript <script> elements, but not inline script event handlers like onclick." ?
  • when is support for script-src-elem coming to Firefox?

Did you test this? If so, how?

MDN Content page report details

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions