Adding CSP to

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

Adding CSP to

Emma Humphries
We're about to enable a Content Security Policy (CSP)(1) on CSP will mitigate several types of attack on our
users and our site, including Cross-Site Request Forgery (XSRF)(2) and
Cross-Site Scripting (XSS)(3).

The first place we're deploying this is in the bug detail page in the new
Modal view (which, you may recall, we're making the default view (4)) with
a goal for the site to have complete CSP coverage.

As a side-effect of this work, CSP may break add-ons that modify the bug
detail page. If we have broken something of yours, we can quickly fix it.
We're already enabling the Socorro Lens add-on(5). You can see how that was

Web Extensions can modify the DOM of a bug detail page through
`content.js`. You cannot load images, javascript, iframes, form actions, or
css from external sites
ā€‹, uā€‹
nless we make an exception for you(7).

Long term, if you have a feature from an add-on you'd like to make part of
BMO, please seek me out on irc:// or open a new ticket
in the product in Bugzilla and set the severity to

Thank you,

Emma (šŸžšŸ‘©)

dev-planning mailing list
[hidden email]