On Friday 2014-06-06 00:30 -0700, Matthew Gertner wrote: > As things stand, it should be possible for responsible extensions such as > ours (we implement our own nsIContentPolicy for our protocol) to do things > like inject CSS into pages.
We should probably have mechanisms for addons to inject CSS into pages without having to insert a <link> into the document, though. Injecting link elements can be observed by the page, could break page script (I've seen scripts looking for the first/last style sheet link to add a rule to it), and can presumably be undone by the page if it wants to break the addon. Having a more distinct mechanism for this might avoid these CSP issues. -David -- 𝄞 L. David Baron http://dbaron.org/ 𝄂 𝄢 Mozilla https://www.mozilla.org/ 𝄂 Before I built a wall I'd ask to know What I was walling in or walling out, And to whom I was like to give offense. - Robert Frost, Mending Wall (1914)
signature.asc
Description: Digital signature
_______________________________________________ dev-platform mailing list [email protected] https://lists.mozilla.org/listinfo/dev-platform
