<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:dbates@webkit.org" title="Daniel Bates <dbates@webkit.org>"> <span class="fn">Daniel Bates</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED WONTFIX - Scripts injected from an isolated world should bypass a page's CSP"
href="https://bugs.webkit.org/show_bug.cgi?id=104305">bug 104305</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>FIXED
</td>
<td>WONTFIX
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED WONTFIX - Scripts injected from an isolated world should bypass a page's CSP"
href="https://bugs.webkit.org/show_bug.cgi?id=104305#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED WONTFIX - Scripts injected from an isolated world should bypass a page's CSP"
href="https://bugs.webkit.org/show_bug.cgi?id=104305">bug 104305</a>
from <span class="vcard"><a class="email" href="mailto:dbates@webkit.org" title="Daniel Bates <dbates@webkit.org>"> <span class="fn">Daniel Bates</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=104305#c4">comment #4</a>)
<span class="quote">> This issue was resolved with the patch for <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED"
href="show_bug.cgi?id=144830">bug #144830</a>.</span >
Disregard this remark. Following the patch for <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED"
href="show_bug.cgi?id=144830">bug #144830</a> subresource loads/JavaScript execution initiated from markup always honor the Content Security Policy of the page regardless of whether such markup was programmatically inserted into the document from an isolated world. That is, markup injected by an extension is not exempt from the Content Security Policy of the page (programmatic resource fetching, say via XHR, is exempt from CSP when initiated in an isolated world). As of the time of writing, we have not heard of any compatibility issues in Safari extension from this change.
For completeness, the patch for <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED"
href="show_bug.cgi?id=144830">bug #144830</a> did exempt user agent shadow DOM markup from CSP because such markup is used to implement browser features and is considered an implementation detail.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>