From 48433dd7a9b0af01528647453a90729f47409d98 Mon Sep 17 00:00:00 2001 From: ryandel8834 Date: Mon, 1 Aug 2016 13:33:18 +0200 Subject: [PATCH] Upstream issues. --- index.html | 38 ++++++++++++++++++++------------------ index.src.html | 4 +++- 2 files changed, 23 insertions(+), 19 deletions(-) diff --git a/index.html b/index.html index 2942cef..5e11f9b 100644 --- a/index.html +++ b/index.html @@ -1933,7 +1933,7 @@

§4.2.3 Should element’s inline type behavior be blocked by Content Security Policy?. This algorithm returns "Allowed" unless otherwise specified.

  • -

    An initialization, which takes a Document or global object, a response, and a policy as +

    An initialization, which takes a Document or global object, a response, and a policy as arguments. This algorithm is executed during §4.2.1 Initialize a Document's CSP list, and has no effect unless otherwise specified.

    @@ -2004,9 +2004,9 @@

    URL matches a source list if the algorithm in §6.1.13.3 Does url match source list? returns Matches.

    2.3. Violations

    A violation represents an action or resource which goes against the - set of policy objects associated with a global object.

    + set of policy objects associated with a global object.

    Each violation has a global object, which - is the global object whose policy has been violated.

    + is the global object whose policy has been violated.

    Each violation has a url which is its global object’s URL.

    Each violation has a status which is a non-negative integer representing the HTTP status code of the resource for @@ -2026,7 +2026,7 @@

    Each violation has a column number, which is a non-negative integer.

    2.3.1. Create a violation object for global, policy, and directive

    -

    Given a global object (global), a policy (policy), and a +

    Given a global object (global), a policy (policy), and a string (directive), the following algorithm creates a new violation object, and populates it with an initial set of data:

    1. @@ -2160,9 +2160,9 @@

      is called as part of step #13 of its Main Fetch algorithm.

    -

    A policy is generally enforced upon a global object, but the +

    A policy is generally enforced upon a global object, but the user agent needs to parse any policy - delivered via an HTTP response header field before any global object is created in order to handle directives that require knowledge of a response’s details. To that end:

    + delivered via an HTTP response header field before any global object is created in order to handle directives that require knowledge of a response’s details. To that end:

    1. A response has an associated CSP list which @@ -2299,12 +2299,12 @@

      §4.2.2 Initialize a global object’s CSP list algorithm.

      This concept is missing from W3C’s Workers. <https://github.com/w3c/html/issues/187>

    2. -

      A policy is enforced or monitored for a global object by inserting it into the global object’s CSP list.

      +

      A policy is enforced or monitored for a global object by inserting it into the global object’s CSP list.

    3. §4.2.2 Initialize a global object’s CSP list is called during the initialising a new Document object and run a worker algorithms in order to bind a set of policy objects associated with a response to a - newly created global object.

      + newly created global object.

    4. §4.2.3 Should element’s inline type behavior be blocked by Content Security Policy? is called during the prepare a script and update a style block algorithms in order to determine whether or not an inline script or style block is allowed to execute/render.

      @@ -2333,7 +2333,8 @@

      object, embed, and applet elements to determine whether they may trigger a fetch.

      Note: Fetched plugin resources are handled in §4.1.4 Should response to request be blocked by Content Security Policy?.

      -

      Upstream this to WHATWG and W3C.

      +

      This hook is missing from WHATWG’s HTML. <https://github.com/whatwg/html/issues/1618>

      +

      This hook is missing from W3C’s HTML. <https://github.com/w3c/html/issues/547>

    4.2.1. Initialize a Document's CSP list

    Given a Document (document), and a response (response), the @@ -2377,7 +2378,7 @@

    4.2.2. Initialize a global object’s CSP list

    -

    Given a global object (global), and a response (response), the user agent performs the following steps in order +

    Given a global object (global), and a response (response), the user agent performs the following steps in order to initialize global’s CSP list:

    1. @@ -2391,7 +2392,7 @@

      -

      For each policy in document’s global +

      For each policy in document’s global object’s CSP list:

      1. @@ -2413,7 +2414,7 @@

        Let result be "Allowed".

      2. -

        For each policy in element’s Document's global object’s CSP list:

        +

        For each policy in element’s Document's global object’s CSP list:

        1. For each directive in policy:

          @@ -3940,7 +3941,7 @@
          Allowed" if base may be used as the value of a base element’s href attribute, and "Blocked" otherwise:

          1. -

            For each policy in document’s global object’s csp list:

            +

            For each policy in document’s global object’s csp list:

            1. Let source list be null.

              @@ -3954,7 +3955,7 @@
              §6.1.13.3 Does url match source list? on base and source list is "Does Not Match":

              1. -

                Let violation be the result of executing §2.3.1 Create a violation object for global, policy, and directive on document’s global +

                Let violation be the result of executing §2.3.1 Create a violation object for global, policy, and directive on document’s global object, policy, and "base-uri".

              2. Set violation’s resource to "inline".

                @@ -4098,7 +4099,7 @@
                This directive’s initialization algorithm is responsible for adjusting a Document's forced sandboxing flag set according to the sandbox values present in its policies, as follows:

                -

                Given a Document or global object (context), a response (response), and a policy (policy):

                +

                Given a Document or global object (context), a response (response), and a policy (policy):

                1. If policy’s disposition is not "Enforce", or context is not a Document, then abort this algorithm.

                  @@ -4126,7 +4127,7 @@

                  6.2.4.1. Algorithms

                  This directive’s initialization algorithm is as follows:

                  -

                  Given a Document or global object (context), a response (response), and a policy (policy):

                  +

                  Given a Document or global object (context), a response (response), and a policy (policy):

                  1. If context’s responsible browsing context has an opener browsing @@ -4741,7 +4742,7 @@

                    fire
                  2. forced sandboxing flag set
                  3. frame -
                  4. global object +
                  5. global object
                  6. http-equiv
                  7. iframe
                  8. incumbent settings object @@ -5025,7 +5026,8 @@

                    <https://github.com/whatwg/html/issues/198> ↵
                    Stylesheet loading is not yet integrated with Fetch in WHATWG’s HTML. <https://github.com/whatwg/html/issues/968> ↵
                    -
                    Upstream this to WHATWG and W3C. ↵
                    +
                    This hook is missing from WHATWG’s HTML. <https://github.com/whatwg/html/issues/1618> ↵
                    +
                    This hook is missing from W3C’s HTML. <https://github.com/w3c/html/issues/547> ↵
                    This needs to be better explained. ↵
                    Do something interesting to the execution context in order to lock down interesting CSSOM algorithms. I don’t think CSSOM gives us any hooks here, so diff --git a/index.src.html b/index.src.html index 69b6d32..5eb409a 100644 --- a/index.src.html +++ b/index.src.html @@ -1126,7 +1126,9 @@

                    Note: Fetched plugin resources are handled in [[#should-block-response]]. - ISSUE: Upstream this to WHATWG and W3C. + ISSUE(whatwg/html#1618): This hook is missing from WHATWG's HTML. + + ISSUE(w3c/html#547): This hook is missing from W3C's HTML.

                    Initialize a `Document`'s `CSP list`