I’m curious. Can you provide an example where CSS can constitute an attack?
How does your CSP stop a script from adding styles to DOM elements? <script> document.querySelector(‘body’) .setAttribute(‘style’, ‘my malicious css?’); </script>
How does your CSP stop a script from adding styles to DOM elements? <script> document.querySelector(‘body’) .setAttribute(‘style’, ‘my malicious css?’); </script>
Edit: As for scripts adding things, the CSP prevents the style attribute being applied iirc.