Page MenuHomePhabricator

Add "object-src 'none'" to the Content-Security-Policy
ClosedPublic

Authored by epriestley on Feb 28 2018, 10:17 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Feb 26, 5:38 AM
Unknown Object (File)
Sun, Feb 9, 5:34 AM
Unknown Object (File)
Sun, Feb 9, 5:34 AM
Unknown Object (File)
Sun, Feb 9, 5:34 AM
Unknown Object (File)
Sun, Feb 9, 5:34 AM
Unknown Object (File)
Jan 28 2025, 3:28 AM
Unknown Object (File)
Jan 25 2025, 12:24 AM
Unknown Object (File)
Jan 25 2025, 12:24 AM
Subscribers
None

Details

Summary

See PHI399. Ref T4340. We don't require Flash/Java anywhere and can safely block them unconditionally in the Content-Security-Policy header.

Test Plan

Added a <object ... /> tag to a page, saw "Blocked Plug-In" and a CSP warning in the browser console.

Diff Detail

Repository
rP Phabricator
Branch
csp2
Lint
Lint Passed
Unit
Tests Passed
Build Status
Buildable 19696
Build 26674: Run Core Tests
Build 26673: arc lint + arc unit

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Mar 1 2018, 1:19 AM
This revision was automatically updated to reflect the committed changes.