Description
CSP is currently blocking some extensions from functioning correctly. So far the ones identified are:
- Extension:CSS
Content Security Policy: The page’s settings blocked the loading of a resource at data:text/css;charset=UTF-8;base64,LnJlZ… (“style-src”).`
- Extension:YouTube
Content Security Policy: The page’s settings blocked the loading of a resource at https://www.youtube-nocookie.com/embed/pSsYTj9kCHE (“frame-src”).
- Extension:EmbedVideo (YouTube and Twitch service, have not tested other services)
- YouTube On Page Load
Content Security Policy: The page’s settings blocked the loading of a resource at https://www.youtube-nocookie.com/oembed?url=https://www.youtube.com/watch?v=uvIHJ5-WLRI (“default-src”).
- YouTube On Click
Content Security Policy: The page’s settings blocked the loading of a resource at https://www.youtube-nocookie.com/embed/uvIHJ5-WLRI (“frame-src”).
- Twitch On Click
Content Security Policy: The page’s settings blocked the loading of a resource at https://player.twitch.tv/?channel=twitchvod&parent=tot.wiki (“frame-src”).
- Extension:TwitterTag
Content Security Policy: The page’s settings blocked the loading of a resource at https://platform.twitter.com/widgets/widget_iframe.f88235f49a156f8b4cab34c7bc1a0acc.html?origin=https%3A%2F%2Ftot.wiki (“frame-src”).
Steps to Reproduce
- Edit a page to use the listed extensions' parser hooks/tag.
- Save page.
- Verify extension is not functioning. In addition, Console will show the CSP errors during page load.
Other Comments
- Unrelated, but the CSP also appears to be blocking some other items across all Wikis as well but unsure what those other items are. For example: https://meta.miraheze.org/wiki/Miraheze