Domains added to script-src and style-src by libraries also need to be included in the corresponding *-src-elem directives. Otherwise, the *-elem directive could be incorrectly more restrictive in supporting browsers.

Policy optimization should remove the *src-elem directive if it is the same as it's corresponding *-src directive and can safely fallback.

Comments

gapple created an issue. See original summary.

  • gapple committed 0a8a1c4 on 8.x-1.x
    Issue #3016229: Add library domains to *-src-elem directives
    
gapple’s picture

Status: Active » Fixed

  • gapple committed fb38be3 on 8.x-1.x
    Issue #3016229: Update Library Policy Builder test for *-src-elem...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.