Skip to content

'unsafe-inline', 'unsafe-eval', nonce-source, hash-source are no-op for most of the source-list directives #22

@shekyan

Description

@shekyan

While 'unsafe-inline', 'unsafe-eval', nonce-source, hash-source are valid source-expression values, only default-src, script-src and style-src define parsing for above keywords.
It would make sense to define something like executable-source-expression with appropriate grammar and use it for default-src, script-src and style-src, while make other source-list directives use source-expression.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions