| Issue 105796: | Enable CSP for extensions by default | |
| 6 people starred this issue and may be notified of changes. | Back to list |
Sign in to add a comment
|
Feature description: Improve the security of the extension system by enabling Content-Security-Policy by default. Our plan is to introduce a manifest_version attribute to the manifest and trigger this behavior on manifest_version>=2. Eng owner: abarth Expected date landing on trunk: Dec 9, 2011 Any new strings? No. Any implications for Google webservices (i.e. sync, translate)? No. *Note: submitting this issue will send email to cross-functional reviewers for launch approval. Please be sure to update the labels below.
Comment
1
by
aba...@chromium.org,
Nov 29, 2011
Labels: -Restrict-View-Commit
,
Nov 29, 2011
(No comment was entered for this change.)
Cc: nepper@chromium.org
,
Dec 6, 2011
(No comment was entered for this change.)
Cc: jhurw...@chromium.org
,
Dec 12, 2011
Technically it won't be on the dev channel until the dev channel updates to M18, but close enough for government work.
Labels: -Dev-Status-WIP Dev-Status-OnDev
,
Dec 13, 2011
(No comment was entered for this change.)
Blockedon: 107402
,
Jan 12, 2012
hey there, It's time to think about whether this feature is ready to ship in M18. Is it enabled-by-default on trunk yet? The M18 branch point is on Jan 30, or just slightly over two weeks from now. Would you still like to target this for M18? (Please adjust the Mstone- label accordingly) We expect M18 to be a relatively light release, given the holidays. thanks, Jeff
,
Jan 12, 2012
This feature is going to take a few cycles to fully land because we want all the pieces in place on the stable channel so we don't end up confusing extension developers. All the pieces we've planned for M18 are in place and enabled on trunk.
,
Jan 24, 2012
Re: comment #7 -- Does that mean the behavior is changing in M18? Or no?
,
Jan 24, 2012
It means that developers can specify manifest_version=2 in m18 and it will result in changed behavior. But that we aren't marketing this feature until m18 is in the stable channel.
,
Jan 25, 2012
(No comment was entered for this change.)
Cc: tse...@chromium.org
,
Jan 27, 2012
as per mkwst's privacy review.
Labels: -Dev-PrivacyReview-No Dev-PrivacyReview-Yes
,
Jan 27, 2012
Reviewed w/ Linus and the TPMs today; we are a Go for M18.
,
Jan 31, 2012
discussed w/ mcginty@ and steng@
Labels: -Dev-LegalReview-No Dev-LegalReview-Yes
,
Feb 3, 2012
(No comment was entered for this change.)
Labels: -Dev-SREReview-No Dev-SREReview-NA
,
Feb 3, 2012
(No comment was entered for this change.)
Labels: -Dev-MarketingReview-No Dev-MarketingReview-NA
,
Feb 3, 2012
(No comment was entered for this change.)
Labels: -Dev-UIReview-No -Dev-StringsReviewed-No Dev-UIReview-NA Dev-StringsReviewed-NA
,
Feb 3, 2012
(No comment was entered for this change.)
Labels: -Dev-AccessibilityReview-No Dev-AccessibilityReview-NA
,
Feb 10, 2012
(No comment was entered for this change.)
Labels: -Dev-ConopsReview-No Dev-ConopsReview-Yes
|
||||||||
| ► Sign in to add a comment | |||||||||