[tor-bugs] #5566 [EFF-HTTPS Everywhere]: [CHROME] One magic flag to hardening CRX and prevent CSP abuse - {"manifest_version": 2}
Tor Bug Tracker & Wiki
blackhole at torproject.org
Mon Mar 17 22:03:28 UTC 2014
#5566: [CHROME] One magic flag to hardening CRX and prevent CSP abuse -
{"manifest_version": 2}
--------------------------------------+--------------------
Reporter: jaedo | Owner: pde
Type: enhancement | Status: closed
Priority: normal | Milestone:
Component: EFF-HTTPS Everywhere | Version:
Resolution: fixed | Keywords:
Actual Points: | Parent ID:
Points: |
--------------------------------------+--------------------
Changes (by zyan):
* status: new => closed
* resolution: => fixed
Comment:
Closing this because Nick Semenkovich writes:
"""
You can close that ticket. Chrome now requires manifest version 2
(which we're using:
https://github.com/EFForg/https-
everywhere/blob/master/chromium/manifest.json
)
Manifest V2 sets a default CSP of: script-src 'self'; object-src
'self' (https://developer.chrome.com/extensions/contentSecurityPolicy
)
Yay! Go us!
Since we're crazy-paranoid, I'll make a pull request for an even more
aggressive CSP (like default-src: none, that we then override).
"""
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5566#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list