<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - CSP Wildcard support"
href="https://bugs.webkit.org/show_bug.cgi?id=160656#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - CSP Wildcard support"
href="https://bugs.webkit.org/show_bug.cgi?id=160656">bug 160656</a>
from <span class="vcard"><a class="email" href="mailto:craig+webkit@craigfrancis.co.uk" title="Craig Francis <craig+webkit@craigfrancis.co.uk>"> <span class="fn">Craig Francis</span></a>
</span></b>
<pre>Hi Daniel,
I see what you mean in regards to WebKit being more restrictive than CSP2, which allows * to match an arbitrary scheme except those in {data:, blob:, and filesystem:}.
Although I think Chrome is about to one up you (with the exception of ws/wss):
<a href="https://twitter.com/sshekyan/status/762873765143322624">https://twitter.com/sshekyan/status/762873765143322624</a>
"<a href="https://codereview.chromium.org/2209113002/">https://codereview.chromium.org/2209113002/</a> lands a breaking change in CSP: "*" only matches http/https/ws/wss, any other schemes have to be whitelisted."
I must admit I didn't test Firefox, but I would hope we can keep CSP as strict as possible (something Chrome seems to be ok with), but realise that backwards compatibility might have to take priority.
I should also thank you for continuing to improve the CSP implementation, it's good to see.
And please ignore my comment about Issue 153090... I wasn't sure if this issue should really have been a comment in that bug (marked as RESOLVED FIXED).</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>