Bug 1448359 Comment 12 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Hey can we revisit this at all I notice lots of things have landed that were blockers?
Revision 1 by
on 
Hey can we revisit this at all I notice lots of things have landed that were blockers? (I'm a little confused what policy we are using as in my nightly it's pretty restricted and yet I see 'prerendered' CSP in files like: browser/components/newtab/prerendered/locales/ach/activity-stream.html)
Revision 2 by
on 
Looking at this again, it looks like all of the issues are resolved. 

The current policy I am seeing is:
default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob:; style-src 'unsafe-inline';

The only thing I see that isn't addressed is the unsafe inline styles. Shall we file that as a low priority follow up bug?

Back to Bug 1448359 Comment 12