1796728 - Firefox console emits a CSP unsafe-inline error, but there is no unsafe-inline script

Status: RESOLVED INCOMPLETE

(Core :: DOM: Security, defect)

Description

[Alexander Konrad]

Attachment: Error

Firefox's console emits this error:

Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src")

It has no line number or any obvious way to track down where it might be coming from. Chrome doesn't have any CSP errors, and whatever is happening doesn't seem to be breaking anything at all.

See details below:
bug 1591807 comment 12
bug 1591807 comment 12
bug 1591807 comment 12

Comment 1

[Christoph Kerschbaumer [:ckerschb}]

Tom, since you are doing lots of CSP works these days, can you take a look?

Comment 2

[Tom Schuster]

Hi Alexander. Thanks for your report. I see that you posted some code snippets in bug 1591807 that presumably reproduce this problem. Would it be possible to get a complete test case (HTML file) for this?

Comment 3

[Tom Schuster]

This is not actionable without at least the CSP and some more example code.