1007205 - CSP allows local CSS @import with only 'unsafe-inline' set
RESOLVED (nobody) in Core - DOM: Security. Last updated 2016-03-23.
bugzilla.mozilla.org