[CB-10324] Derive whitelist tags from CSP

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Won't Do
• Affects Version/s: 4.0.1
• Component/s: cordova-android, cordova-ios
• Assignee: Unassigned
• Reporter: Gregor Schmidt
• Created: 12/Jan/16 12:20
• Updated: 29/Nov/19 12:46
• Resolved: 29/Nov/19 12:46

Description

When dynamically creating an iframe, the iframe's src is never loaded. This worked without issues using 3.9.2.

Example Code:

i = document.createElement("iframe");
i.src = "https://example.org";
document.body.appendChild(i);

Please note, that you have to extend the Content-Security-Policy headers to include https: to pass CSP restrictions.

I have also created a sample project to reproduce the problem. You may find it at https://github.com/schmidt/cordova-ios-iframe-example