|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This commit adds a Content-Security-Policy to HTML documents for exported
bookmarks. The change will stop active content (like bookmarklets) from being
directly runnable in the exported local file, which is *not* breaking the
normal use case in which a bookmarklet is intended to modify an existing page.
It *will* affect the use case where you have a full website/application stored
in a bookmarklet that was supposed to replace the current web page. In this
case, users can right-click copy the link and drop it in the address bar.
Note: The CSP does not mean that this is a severe attack vector. It merely
provides a basic protection measure for users who use the exported bookmarks in
a non-standard way as a local file.
|