We have CSP enabled on the certified apps in which jsonp will not work, and
systemxhr bypasses cors checks

but the point is we dont have any apps that require that functionality, so
as you said we shouldnt be adding it or spending effort thinking about it,
as per the first comment

On 14 February 2013 20:29, Rick Waldron <notifications@github.com> wrote:

> In shared/js/lazy_loader.js:
>
> > +      document.head.appendChild(style);
> > +      callback();
> > +    },
> > +
> > +    load: function(files, callback) {
> > +      if (!Array.isArray(files))
> > +        files = [files];
> > +
> > +      var loadsRemaining = files.length, self = this;
> > +      function perFileCallback(file) {
> > +        var node = self._inDOM[file];
> > +        if (node) {
> > +          // Remove the node from the DOM (for cases like JSON-P usage)
> > +          node.parentNode.removeChild(node);
> > +          delete self._inDOM[file];
> > +        }
>
> @daleharvey <https://github.com/daleharvey> @mozsquib<https://github.com/mozsquib>...what happens if the remote service isn't CORS enabled and only offers
> JSONP?
>
> Regardless of whether or not it's a security issue, you can still do JSONP
> with this or anything that loads scripts with a script tags. Not removing
> the script element just means the heap will grow with every request.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/mozilla-b2g/gaia/pull/8088/files#r3019597>.
>
>