Mozilla: Content security policy bypass through hash-based sources in directives

If a Content Security Policy CSP directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox 6...

PT-2019-5152

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 69 Firefox ESR versions prior to 68.1 Description The issue is related to Content Security Policy CSP directives that use hash-based sources. If such a directive is defined with an empty string as input, it allows the...