Content-Security-Policy disallow 'object-src' by default

[Malvoz]

Google's csp-evaluator is complaining whenever the fetch-directive object-src is missing (unless default-src is 'none', which is rarely done in the wild). I reported this to webhint aswell.

object-src, per the spec, "acts upon any request made on behalf of an <object>, <embed>, or <applet> element" and can be used to allow plugin-types such as application/x-shockwave-flash (also, this directive may be removed from the web platform).

These elements are largely considered legacy elements that do not recieve new standardized security features such as (<iframe>) sandbox or allow attributes.

The recommendation is documented in https://csp.withgoogle.com/docs/strict-csp.html, and https://csp.withgoogle.com/docs/faq.html#comparison:

Since setting directives other than script-src and object-src doesn't increase the protection against cross-site scripting, and it adds adoption and maintenance costs of CSP, we believe most applications should focus on deploying the baseline strict policy as the most high-impact improvement.

I don't have knowledge of how common it is or which other types of plugins may be used. I think people use <object> to embed PDFs etc. However, I don't think developers implementing a CSP today is still using these legacy elements.

WDYT?