Wikimedia's CommonSettings.php currently contains the following code, which (IIUC) adds a custom report-only Content Security Policy header to responses that get sent by foundationwiki (https://foundation.wikimedia.org/):
if ( $wgDBname === 'foundationwiki' ) { // Foundationwiki has raw html enabled. Attempt to prevent people // from accidentally violating the privacy policy with external scripts. // Note, we need all WMF domains in here due to Special:HideBanners // being loaded as an image from various domains on donation thank you // pages. $wgHooks['BeforePageDisplay'][] = static function ( $out, $skin ) { $resp = $out->getRequest()->response(); $cspHeader = "default-src *.wikimedia.org *.wikipedia.org *.wiktionary.org *.wikisource.org *.wikibooks.org *.wikiversity.org *.wikiquote.org *.wikinews.org www.mediawiki.org www.wikidata.org *.wikifunctions.org *.wikivoyage.org data: blob: 'self'; script-src *.wikimedia.org 'unsafe-inline' 'unsafe-eval' 'self'; style-src *.wikimedia.org data: 'unsafe-inline' 'self'; report-uri /w/api.php?action=cspreport&format=none&reportonly=1&source=wmfwiki&"; $resp->header( "Content-Security-Policy-Report-Only: $cspHeader" ); }; }
From what I can see, it seems like this was added in March 2017 by https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/341259 ("Add a CSP policy to foundationwiki to prevent privacy breach"), for T159386: Make abusefilter on foundationwiki to prevent people accidentally violating our privacy policy.
The code's comments refer to it being in place due to foundationwiki having raw HTML enabled. However, from what I can see, $wgRawHtml was disabled for foundationwiki in November 2018 by https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/462834 (for T201285: Disable raw HTML in https://foundation.wikimedia.org/).
So I guess my question is -- given the above, can this custom config now be safely removed; & if so, should it be?