w3c/webappsec-csp issues and pull requests

#646 - Fix reference link for [TIMING]

Pull Request - State: closed - Opened by antosart 4 months ago

#645 - Remove required condition on the attributes fror SecurityPolicyViolationEventInit dict

Pull Request - State: closed - Opened by SaeidEid 4 months ago

#644 - [TIMING] references broken

Issue - State: closed - Opened by bkardell 5 months ago

#643 - "Is element nonceable" not applied to non-<script> elements in Chrome?

Issue - State: open - Opened by evilpie 5 months ago

#642 - Add `[SecureContext]` tag to the interfaces

Pull Request - State: open - Opened by OnkarRuikar 5 months ago - 1 comment

#640 - Why is the Content-Security-Policy-Report-Only header field not supported in `<meta>` elements?

Issue - State: closed - Opened by mbrodesser-Igalia 5 months ago - 5 comments

#639 - Add optional trailing dot to host-part

Pull Request - State: closed - Opened by SaeidEid 5 months ago - 1 comment

#638 - `service-worker-src` directive

Issue - State: open - Opened by bakkot 6 months ago

#637 - Resource hint: check directives explicitly

Pull Request - State: open - Opened by noamr 6 months ago

#636 - Is-element-nonceable should check if the attribute's name |contains| <script or <style>

Pull Request - State: closed - Opened by evilpie 6 months ago

#635 - Does "Is Element Nonceable" apply to non-inline scripts?

Issue - State: open - Opened by evilpie 6 months ago - 1 comment

#634 - Chrome/Safari trim nonces

Issue - State: open - Opened by evilpie 6 months ago - 11 comments

#633 - Resource hint blocking / "least restrictive" as specified does nothing?

Issue - State: open - Opened by evilpie 6 months ago - 4 comments

#632 - Some way to allow workers other than URL and strict-dynamic

Issue - State: open - Opened by bakkot 7 months ago

#631 - Problem with SecurityPolicyViolationEvent constructor and optional init dict

Issue - State: closed - Opened by evilpie 7 months ago - 9 comments

#630 - Replace RFC7231 with RFC9110

Pull Request - State: closed - Opened by antosart 7 months ago

#629 - Normative references to discontinued specs in Content Security Policy Level 3

Issue - State: closed - Opened by dontcallmedom-bot 7 months ago

#628 - CSP:EE does not support Trusted Types CSP directives

Issue - State: open - Opened by tosmolka 7 months ago - 1 comment

#625 - Allow 'strict-dynamic' scripts to inject styles

Issue - State: open - Opened by vejja 8 months ago - 1 comment

#624 - frame-src using the fetch instead of the navigational check - can end up checking the wrong policies

Issue - State: open - Opened by antosart 8 months ago

#624 - frame-src using the fetch instead of the navigational check - can end up checking the wrong policies

Issue - State: open - Opened by antosart 8 months ago

#623 - Allow `script-src 'unsafe-hashes'` for `eval()` and `new Function`

Issue - State: open - Opened by nicolo-ribaudo 8 months ago - 8 comments

#623 - Allow `script-src 'unsafe-hashes'` for `eval()` and `new Function`

Issue - State: open - Opened by nicolo-ribaudo 8 months ago - 8 comments

#622 - Remove RECOMMENDATION to not send multiple CSP headers

Pull Request - State: closed - Opened by JannisBush 10 months ago - 2 comments

#622 - Remove RECOMMENDATION to not send multiple CSP headers

Pull Request - State: closed - Opened by JannisBush 10 months ago - 2 comments

#621 - [editorial] Make algorithm headers clickable

Pull Request - State: open - Opened by antosart 10 months ago - 1 comment

#621 - [editorial] Make algorithm headers clickable

Pull Request - State: open - Opened by antosart 10 months ago - 1 comment

#620 - CSP not working for certain hostnames

Issue - State: closed - Opened by enexusde 10 months ago - 18 comments

#619 - [editorial] Add missing semicolons in example CSP

Pull Request - State: closed - Opened by antosart 10 months ago

#619 - [editorial] Add missing semicolons in example CSP

Pull Request - State: closed - Opened by antosart 10 months ago

#618 - Algorithms should be <dfn> in prose instead of linked to headers

Issue - State: open - Opened by johnathan79717 10 months ago - 6 comments

#618 - Algorithms should be <dfn> in prose instead of linked to headers

Issue - State: open - Opened by johnathan79717 10 months ago - 6 comments

#617 - Example 26 syntax error - missing 2 semicolons

Issue - State: closed - Opened by AlbertWiersch 11 months ago

#617 - Example 26 syntax error - missing 2 semicolons

Issue - State: closed - Opened by AlbertWiersch 11 months ago

#616 - [editorial] Fix typo

Pull Request - State: closed - Opened by antosart 11 months ago

#616 - [editorial] Fix typo

Pull Request - State: closed - Opened by antosart 11 months ago

#615 - Typo in 8.4 Allowing external JavaScript via hashes

Issue - State: closed - Opened by mauke 11 months ago - 1 comment

#615 - Typo in 8.4 Allowing external JavaScript via hashes

Issue - State: closed - Opened by mauke 11 months ago - 1 comment

#614 - [editorial] Change fallback effective directive to connect-src

Pull Request - State: closed - Opened by antosart 11 months ago - 1 comment

#614 - [editorial] Change fallback effective directive to connect-src

Pull Request - State: closed - Opened by antosart 11 months ago - 1 comment

#613 - [editorial] Fix reference to url

Pull Request - State: closed - Opened by antosart 11 months ago

#613 - [editorial] Fix reference to url

Pull Request - State: closed - Opened by antosart 11 months ago

#612 - Reference the strict-dynamic issue for inline scripts

Pull Request - State: closed - Opened by evilpie 11 months ago - 1 comment

#612 - Reference the strict-dynamic issue for inline scripts

Pull Request - State: closed - Opened by evilpie 11 months ago - 1 comment

#611 - Add `"json"` destination for `"connect-src"`

Pull Request - State: closed - Opened by nicolo-ribaudo 11 months ago - 8 comments

#611 - Add `"json"` destination for `"connect-src"`

Pull Request - State: closed - Opened by nicolo-ribaudo 11 months ago - 8 comments

#610 - CSP: Embedded Enforcement Links for issue 16 and 17 are dead

Issue - State: open - Opened by JannisBush 12 months ago

#610 - CSP: Embedded Enforcement Links for issue 16 and 17 are dead

Issue - State: open - Opened by JannisBush 12 months ago

#609 - Behavior of `worker-src 'strict-dynamic'`

Issue - State: open - Opened by evilpie 12 months ago - 8 comments

#608 - Remove WPTs for spec-removed `navigate-to` directive

Issue - State: open - Opened by CanadaHonk about 1 year ago - 4 comments

#608 - Remove WPTs for spec-removed `navigate-to` directive

Issue - State: open - Opened by CanadaHonk about 1 year ago - 4 comments

#607 - Export DFNs used in Permissions-Policy

Pull Request - State: closed - Opened by arichiv about 1 year ago - 1 comment

#607 - Export DFNs used in Permissions-Policy

Pull Request - State: closed - Opened by arichiv about 1 year ago - 1 comment

#606 - [Editorial] Fix link to published CSP 2

Pull Request - State: closed - Opened by bwbroersma about 1 year ago - 1 comment

#606 - [Editorial] Fix link to published CSP 2

Pull Request - State: closed - Opened by bwbroersma about 1 year ago - 1 comment

#605 - [Editorial] Fix link to published CSP 2 in README.md

Issue - State: closed - Opened by bwbroersma about 1 year ago

#605 - [Editorial] Fix link to published CSP 2 in README.md

Issue - State: closed - Opened by bwbroersma about 1 year ago

#604 - Export DFNs used in Permissions-Policy

Issue - State: closed - Opened by arichiv about 1 year ago

#604 - Export DFNs used in Permissions-Policy

Issue - State: closed - Opened by arichiv about 1 year ago

#603 - GIAO DICH. NHAN. TIEN CHUYEN? TIEN TREN KHAP' THE' GIOI'

Issue - State: closed - Opened by 0924249460 about 1 year ago