Some examples: Exceptions, action=raw, load.php, etc.
As a precaution, it wouldn't hurt for us to send a really restrictive CSP (e.g. default-src 'self'; script-src 'none'; object-src 'none' ) as a paranoia measure for such output. There should be no active html in such a case, so it shouldn't hurt anything.
Not counting: things that output images [its a bit more complex with svg and pdf], RSS [I don't know how this interact with embedded html snippets]
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Send restrictive CSP header on things that do custom output | mediawiki/core | master | +39 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T28508 Content Security Policy (CSP) | |||
| Open | None | T246639 Consider sending restrictive CSP in cases where $wgOut->disable() is called and scripting not needed |
Change 575993 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/core@master] [WIP] Send restrictive CSP header on things that do custom output