Comment # 5 on bug 1220190 from Matthias Gerstner

So none of the findings in comment 4 is a hard blocker for whitelisting this.
Taking it all together it feels pretty shaky still though. You should
forward this to upstream so that they have a chance to improve on this.