{"action":"opened","issue":{"url":"https://api.github.com/repos/mozilla/addons-server/issues/3440","repository_url":"https://api.github.com/repos/mozilla/addons-server","labels_url":"https://api.github.com/repos/mozilla/addons-server/issues/3440/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/addons-server/issues/3440/comments","events_url":"https://api.github.com/repos/mozilla/addons-server/issues/3440/events","html_url":"https://github.com/mozilla/addons-server/issues/3440","id":175578277,"number":3440,"title":"about:blank CSP violation for base-uri directive","user":{"login":"muffinresearch","id":1514,"avatar_url":"https://avatars.githubusercontent.com/u/1514?v=3","gravatar_id":"","url":"https://api.github.com/users/muffinresearch","html_url":"https://github.com/muffinresearch","followers_url":"https://api.github.com/users/muffinresearch/followers","following_url":"https://api.github.com/users/muffinresearch/following{/other_user}","gists_url":"https://api.github.com/users/muffinresearch/gists{/gist_id}","starred_url":"https://api.github.com/users/muffinresearch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffinresearch/subscriptions","organizations_url":"https://api.github.com/users/muffinresearch/orgs","repos_url":"https://api.github.com/users/muffinresearch/repos","events_url":"https://api.github.com/users/muffinresearch/events{/privacy}","received_events_url":"https://api.github.com/users/muffinresearch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-07T18:51:50Z","updated_at":"2016-09-07T18:51:50Z","closed_at":null,"body":"After updating django-csp we have added the directives, `base-uri`, `form-action` and `child-src`. (on -dev only at the moment)\r\n\r\nVisiting https://addons-dev.allizom.org I see a CSP violation with the following:\r\n\r\n_Content Security Policy: The page's settings blocked the loading of a resource at about:blank (\"base-uri https://addons-dev.allizom.org https://addons.mozilla.org https://addons-dev.allizom.org\")._\r\n\r\n### What did you expect to happen?\r\n\r\nNo CSP violations\r\n\r\n### Anything else we should know?\r\n\r\nURL: https://addons-dev.allizom.org\r\n\r\n"}}
{"actor":{"display_login":"muffinresearch"}}