An all-new reason to use Content-Security-Policy.
How much you want to bet that thing is XSSable?
How much you want to bet that thing is XSSable?
Correct me if I'm wrong, but I don't think any amount of CSP will help you in this situation. They're MITMing traffic and thus can modify the CSP headers.