15476 2012-01-09 18:21:40 +0000 [Templates]: Specify how templates work 2015-07-06 07:06:37 +0000 1 1 1 Unclassified WebAppsWG HISTORICAL - Component Model unspecified PC All RESOLVED FIXED P2 normal --- 15454 15540 15541 15542 15663 15698 15857 16277 16278 16279 16280 16340 16341 16787 16788 16810 17459 17679 18597 18598 18607 18608 18613 18614 18672 18710 18713 18725 18735 18794 18926 19002 19237 19403 19408 19415 19455 19456 19485 19486 19487 19488 19567 19889 19890 19966 20030 20127 20129 20130 20483 20531 20563 20797 20829 20848 20849 20892 20924 21017 21228 21293 21430 21647 21809 22400 23409 23628 23752 14972 1 dglazkov dglazkov fb+w3c hayato hsivonen rafaelw simon_kaegi tross public-webapps-bugzilla oldest_to_newest 62425 0 dglazkov 2012-01-09 18:21:40 +0000 This is the umbrella bug for tracking specification of the <template> element and associated plumbing 86455 1 fb+w3c 2013-04-21 13:30:00 +0000 Quick question: How does CSP interact with Web Components? E. g. if I disable inline scripts (same applies to inline-styles) via CSP, is a <template>'s script affected? (It probably should not. If this is not specified yet, shall I file a bug?) This leads me to the question: Is it possible to inject malicious scripts via Web Components, i. e. by injecting a link[rel="components"] pointing to malicious templates?