Hosting ScanJS with a CSP? about scanjs

[mozfreddyb]

I agree that we should do that
I think the rewriting part is pretty easy and I'll try to do this today.

But we can't really apply a CSP in the HTTP Header as long as we host on GitHub :(
(and policies in meta tags aren't supported in Firefox yet, see https://bugzil.la/663570)

[mozfreddyb]

The rewriting bits have been fairly easy. The reason why this is already merged is discussed in #26.

Leaving this open to discuss hosting and headers, although it should already works with Blink/WebKit browsers (tested chromium 32)

[pauljt]

Sorry I didn't realise you guys actually worked on this - commented the meta-tag in the last commit. I'll remove the CSP which I commented out ;)

[pauljt]

Done

[pauljt]

Why do we need eval btw? Just curious ?

[pwnetrationguru]

TL;DR - I think because of acorn.js
According to freddyb, "but we have to allow eval/Function because of acorn.js :(".

[mozfreddyb]

Not only acorn. scan.js also uses Function.
We can also use this issue to discuss making the rules stricter. I'm sure this could be doable.

[mozfreddyb]

This is partially covered with #65, but not quite..