corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1953866 - Add a strict script-src CSP to browser.xhtml for Nightly/Beta. r=freddyb,firefox-desktop-core-reviewers ,mossop

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D242273
This commit is contained in:
Tom Schuster
2025-04-01 10:39:54 +00:00
parent 8ddc20523c
commit 02c4420952
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
browser/base/content/browser.xhtml
View File

@@ -30,7 +30,11 @@
data-l10n-sync="true">
<head>
<!-- CSP might be disabled by C++ code. -->
#if defined(EARLY_BETA_OR_EARLIER)
<meta http-equiv="Content-Security-Policy" content="script-src chrome: moz-src: resource: 'report-sample'" />
#else
<meta http-equiv="Content-Security-Policy" content="script-src-attr 'none' 'report-sample'" />
#endif
<!-- The "global.css" stylesheet is imported first to allow other stylesheets to
override rules using selectors with the same specificity. This applies to