Asking csadilek what should be the course of action here: - Use `<meta http-equiv="Content-Security-Policy" content="default-src resource:; script-src resource: 'unsafe-inline'; object-src 'none'">` which must be used in conjuction with the proper sanitization (like in #1657055) - Use `<meta http-equiv="Content-Security-Policy" content="default-src resource:; object-src 'none'">` but having to refactor all the error pages o not use inline scripts.
Bug 1658276 Comment 12 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Asking csadilek what should be the course of action here: - Use `<meta http-equiv="Content-Security-Policy" content="default-src resource:; script-src resource: 'unsafe-inline'; object-src 'none'">` which must be used in conjuction with the proper sanitization (like in #1657055) - Use `<meta http-equiv="Content-Security-Policy" content="default-src resource:; object-src 'none'">` but having to refactor all the error pages to not use inline scripts.