Content Security Policy Bypass

firefox is vulnerable to content security policy (CSP) bypass. When an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy is not applied to the contents of the XSL stylesheet, allowing an attacker to bypass the CSP using Javascript in the XML.