[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #5566 [EFF-HTTPS Everywhere]: [CHROME] One magic flag to hardening CRX and prevent CSP abuse - {"manifest_version": 2}

#5566: [CHROME] One magic flag to hardening CRX and prevent CSP abuse -
{"manifest_version": 2}
--------------------------------------+--------------------
     Reporter:  jaedo                 |      Owner:  pde
         Type:  enhancement           |     Status:  closed
     Priority:  normal                |  Milestone:
    Component:  EFF-HTTPS Everywhere  |    Version:
   Resolution:  fixed                 |   Keywords:
Actual Points:                        |  Parent ID:
       Points:                        |
--------------------------------------+--------------------
Changes (by zyan):

 * status:  new => closed
 * resolution:   => fixed


Comment:

 Closing this because Nick Semenkovich writes:
 """
 You can close that ticket. Chrome now requires manifest version 2
 (which we're using:
 https://github.com/EFForg/https-
 everywhere/blob/master/chromium/manifest.json
 )

 Manifest V2 sets a default CSP of: script-src 'self'; object-src
 'self'  (https://developer.chrome.com/extensions/contentSecurityPolicy
 )

 Yay! Go us!

 Since we're crazy-paranoid, I'll make a pull request for an even more
 aggressive CSP (like default-src: none, that we then override).
 """

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5566#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs