I found a website that has a very strict but malformed Content Security Policy of the form:
Content-Security-Policy: script-src none
which should actually be
Content-Security-Policy: script-src 'none'
Firefox shows warnings
Content Security Policy: Interpreting http://none as a hostname, not a keyword. If you intended this to be a keyword, use ‘none’ (wrapped in single quotes).
Content Security Policy: Interpreting none as a hostname, not a keyword. If you intended this to be a keyword, use ‘none’ (wrapped in single quotes).
Can this be exploited by generating a server that would satisfy the hostname requirement? How would a hostname address like this look like?