So the RFC process page says I should email wikitech-l to propose an RFC, thus:

Content-Security-Policy (CSP) header is a header that disables certain javascript features that are commonly used to exploit XSS attacks, in order to mitigate the risks of XSS. I think we could massively benefit from using this technology - XSS attacks probably being the most common security issue in MediaWiki. The downside is that it would break compatibility with older user scripts.

Please see the full text of my proposal at https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy

The associated phabricator ticket is: https://phabricator.wikimedia.org/T135963

I'd appreciate any comments anyone might have.

Thanks, Brian