Comment on Hardening the Firefox Front End with Content Security PoliciesparentComments−gear54rus1yOne of the possible workarounds would be to just remove the damn header before it causes any further inconvenience. I think they do allow `webRequest` API usage in the store, don't they?−evilpieOP1yRemoving security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.https://extensionworkshop.com/documentation/publish/add-on-p...−gear54rus1yI don't think this is being enforced in practice, thankfully.−davidmurdoch1yIt is. It happened to us a few weeks ago.−gear54rus1yThat's crazy. Did it happen to a public extension or an unlisted one?−davidmurdoch1yPublic, with about half a million installations.I think it was noticed only because this version had a major bug that broke a bunch of websites.−davidmurdoch1yWe modified the CSP to inject a per user generated nonce that exempts it script from the policy.They said this was not allowed and removed it from the extension store.
Comments
One of the possible workarounds would be to just remove the damn header before it causes any further inconvenience. I think they do allow `webRequest` API usage in the store, don't they?
Removing security headers like Content-Security-Policy is forbidden by the addons.mozilla.org policy.
https://extensionworkshop.com/documentation/publish/add-on-p...
I don't think this is being enforced in practice, thankfully.
It is. It happened to us a few weeks ago.
That's crazy. Did it happen to a public extension or an unlisted one?
Public, with about half a million installations.
I think it was noticed only because this version had a major bug that broke a bunch of websites.
We modified the CSP to inject a per user generated nonce that exempts it script from the policy.
They said this was not allowed and removed it from the extension store.