Mailing list thread: http://markmail.org/message/6jqt5f3t4iio52td
Also @apache: https://mail-archives.apache.org/mod_mbox/cordova-dev/201407.mbox/%3CCADVgkyNN3EKT4xiRXJFbwMGFhsrVF3kHQRzd3exvb5nW7_GdfA%40mail.gmail.com%3E
Ideally the network policy is completely removed from Cordova core, and replaced with a small set of plugin hooks so that different kinds of policies can be implemented in different plugins. The current whitelist implementation can be an example plugin provided for backwards-compatibility.
It should also be possible, once this is removed, to control the webview's network policy with CSP, in most platforms.