Page MenuHomePhabricator

Add "object-src 'none'" to the Content-Security-Policy

Authored by epriestley on Feb 28 2018, 10:17 PM.



See PHI399. Ref T4340. We don't require Flash/Java anywhere and can safely block them unconditionally in the Content-Security-Policy header.

Test Plan

Added a <object ... /> tag to a page, saw "Blocked Plug-In" and a CSP warning in the browser console.

Diff Detail

rP Phabricator
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

epriestley created this revision.Feb 28 2018, 10:17 PM
epriestley requested review of this revision.Feb 28 2018, 10:18 PM
This revision was not accepted when it landed; it landed in state Needs Review.Mar 1 2018, 1:19 AM
This revision was automatically updated to reflect the committed changes.