/
409.txt
158 lines (119 loc) · 7.11 KB
/
409.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
[1] [CITE@en[Security/CSP - MozillaWiki]]
([TIME[2009-10-09 22:03:58 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP>
[2] [CITE@en[Security/CSP/Spec - MozillaWiki]]
([TIME[2009-11-04 04:19:11 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP/Spec>
[3] [CITE@en[Security/CSP/Specification - MozillaWiki]]
([TIME[2010-05-22 03:46:34 +09:00]] 版)
<https://wiki.mozilla.org/Security/CSP/Specification>
[4] [CITE@en[XSS mitigation in browsers]]
( ([[Adam Barth]] 著, [TIME[2011-01-20 07:42:47 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-web-security/2011Jan/0002.html>
[5] [CITE@en[Content Security Policy]]
( ([TIME[2011-12-01 01:03:34 +09:00]] 版))
<http://www.w3.org/TR/2011/WD-CSP-20111129/>
[6] [CITE[IRC logs: freenode / #whatwg / 20111206]]
( ([TIME[2011-12-06 21:54:13 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20111206>
[7] [CITE['''['''whatwg''']''' CSP sandbox directive integration with HTML]]
([TIME[2011-12-07 09:36:37 +09:00]] 版)
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-December/034071.html>
[8] [CITE@en[Content Security Policy]]
( ([TIME[2012-04-14 10:44:44 +09:00]] 版))
<http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html>
[9] [CITE@en[draft-gondrom-websec-csp-header-00 - HTTP Header Content Security Policy]]
( ([TIME[2012-03-06 21:39:17 +09:00]] 版))
<http://tools.ietf.org/html/draft-gondrom-websec-csp-header-00>
[10] [CITE[Content Security Policy (CSP) - Google Chrome Extensions - Google Code]]
( ([TIME[2012-07-04 21:12:09 +09:00]] 版))
<http://code.google.com/chrome/extensions/contentSecurityPolicy.html>
[11] [CITE@en[Content Security Policy 1.0]]
( ([TIME[2012-07-08 08:24:03 +09:00]] 版))
<http://www.w3.org/TR/2012/WD-CSP-20120710/>
[12] [CITE@en[Content Security Policy 1.0]]
( ([TIME[2012-11-15 02:39:08 +09:00]] 版))
<http://www.w3.org/TR/2012/CR-CSP-20121115/>
[13] [CITE@en[User Interface Safety Directives for Content Security Policy]]
( ([TIME[2012-11-20 22:47:37 +09:00]] 版))
<http://www.w3.org/TR/2012/WD-UISafety-20121120/>
[14] [CITE[Content Security Policy 1.1]]
( ([TIME[2012-12-13 23:00:55 +09:00]] 版))
<http://www.w3.org/TR/2012/WD-CSP11-20121213/>
[15] [CITE[Chromium Blog: Chrome 25 Beta: Content Security Policy and Shadow DOM]]
( ([TIME[2013-01-16 03:52:16 +09:00]] 版))
<http://blog.chromium.org/2013/01/content-security-policy-and-shadow-dom.html>
[16] [CITE@en[Runtime and Security Model for Web Applications]]
( ([TIME[2013-03-21 23:02:32 +09:00]] 版))
<http://www.w3.org/TR/2013/WD-runtime-20130321/#csp-policy>
[17] [CITE@en[User Interface Security Directives for Content Security Policy]]
( ([TIME[2013-05-22 21:37:57 +09:00]] 版))
<http://www.w3.org/TR/2013/WD-UISecurity-20130523/>
[18] [CITE[Chromium Blog: Chrome 28 Beta: A more immersive web, everywhere]]
( ([TIME[2013-05-23 17:42:48 +09:00]] 版))
<http://blog.chromium.org/2013/05/chrome-28-beta-more-immersive-web.html>
[19] [CITE@en[Content Security Policy 1.1]]
( ([TIME[2013-06-04 06:35:02 +09:00]] 版))
<http://www.w3.org/TR/2013/WD-CSP11-20130604/>
[20] [CITE[Content Security Policy (CSP) - Google Chrome]]
( ([TIME[2013-10-13 01:58:37 +09:00]] 版))
<http://developer.chrome.com/extensions/contentSecurityPolicy.html>
[21] [CITE@en-US[Default CSP restrictions - Security | MDN]]
( ([TIME[2013-10-01 06:35:59 +09:00]] 版))
<https://developer.mozilla.org/en/docs/Security/CSP/Default_CSP_restrictions>
[22] [CITE@en-US[Introducing Content Security Policy - Security | MDN]]
( ([TIME[2013-09-30 19:27:42 +09:00]] 版))
<https://developer.mozilla.org/en-US/docs/Security/CSP/Introducing_Content_Security_Policy>
[23] [CITE@en[''''''[''''''webappsec'''''']'''''' Proposal: Closing the feature set of CSP 1.1]]
( ([[Brad Hill]] 著, [TIME[2013-09-10 09:14:02 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2013Sep/0019.html>
[24] [CITE@en[Content Security Policy 1.1]]
( ([TIME[2014-01-16 14:18:10 +09:00]] 版))
<http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html>
[25] [CITE[Bug 2494 – Add hooks for CSP]]
( ([TIME[2014-02-05 07:24:56 +09:00]] 版))
<https://bugs.ecmascript.org/show_bug.cgi?id=2494>
[26] [CITE@en[Content Security Policy 1.1]]
( ([TIME[2014-02-11 06:15:48 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-CSP11-20140211/>
[27] [CITE@en[User Interface Security Directives for Content Security Policy]]
( ([TIME[2014-03-15 06:10:22 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-UISecurity-20140318/>
[28] [CITE@en[User Interface Security Directives for Content Security Policy]]
( ([TIME[2014-04-25 10:54:40 +09:00]] 版))
<https://dvcs.w3.org/hg/user-interface-safety/raw-file/tip/user-interface-safety.html>
[29] [CITE[Clarify MIX and CSP hooks a bit · 682f68d · whatwg/fetch]]
( ([TIME[2014-06-16 03:02:02 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/682f68d5f0cce7f9637a8f6d9450b514ed276f9b>
[30] [CITE[Put MIX/CSP hooks in switch. Put second MIX check before tainting. · 567fe8a · whatwg/fetch]]
( ([TIME[2014-06-16 03:05:42 +09:00]] 版))
<https://github.com/whatwg/fetch/commit/567fe8ad5f1804efdefa7aa273f2a366b223c70e>
[31] [CITE@en[Content Security Policy Level 2]]
( ([TIME[2014-07-03 04:53:53 +09:00]] 版))
<http://www.w3.org/TR/2014/WD-CSP2-20140703/>
[32] [CITE@en["Why is CSP failing? Trends and Challenges in CSP Adoption"]]
( ([[Oda, Terri]] 著, [TIME[2014-07-24 03:26:19 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Jul/0100.html>
[33] ( ([TIME[2014-07-15 00:50:45 +09:00]] 版))
<http://mweissbacher.com/publications/csp_raid.pdf>
[34] [CITE@en[''''''[''''''webappsec'''''']'''''' Call for Consensus: CSP Level 2 to Candidate Recommendation]]
( ([[Brad Hill]] 著, [TIME[2014-10-21 08:02:34 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Oct/0063.html>
[35] [CITE@en[''''''[''''''webappsec'''''']'''''' Call for Consensus: Stop work on Content Security Policy 1.0, transition to WG Note]]
( ([[Brad Hill]] 著, [TIME[2014-10-21 08:13:56 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Oct/0064.html>
[36] [CITE@en[CSP3: Starting on DOM API strawman. · 92b8dd4 · w3c/webappsec]]
( ([TIME[2014-11-04 03:23:06 +09:00]] 版))
<https://github.com/w3c/webappsec/commit/92b8dd4778ad1a237e5b5be015f9482bd3ad2ff4>
[37] [CITE@en[CSP3: DOM API Strawman]]
( ([[Mike West]] 著, [TIME[2014-11-03 22:24:45 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0005.html>
[38] [CITE@en[''''''[''''''webappsec'''''']'''''' Rechartering: CSP Level 3]]
( ([[Brad Hill]] 著, [TIME[2014-11-10 09:02:46 +09:00]] 版))
<http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0126.html>
[39] [CITE@en[Official Gmail Blog: Reject the unexpected - Content Security Policy in Gmail]]
( ([TIME[2014-12-19 08:00:09 +09:00]] 版))
<http://gmailblog.blogspot.jp/2014/12/reject-unexpected-content-security.html>
[40] [CITE@en[Fix the order of CSP, HSTS, Mixed Content, and Referrer https://www.w3.o... · b8c2c49 · whatwg/fetch]]
([TIME[2015-01-28 18:20:53 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/b8c2c4964c233cd3616042c04e2c14e0ff25485d>