The app's CSP is: "csp": "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'"
CSP should also require trusted types for scripts to lock down DOM XSS injection sinks by adding require-trusted-types-for 'script' to the policy.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | sbassett | T240869 Security Review For KaiOS Wikipedia app | |||
| Declined | None | T253142 CSP improvement |
(Please remove unrelated project tags (and subscribers) when creating subtasks - thanks!)
This feature appears to be experimental and unsupported by Firefox.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/trusted-types