From 812239958b460b33733a21d4269a67877c8c6439 Mon Sep 17 00:00:00 2001 From: Mike West Date: Thu, 14 Apr 2016 13:16:51 +0200 Subject: [PATCH 1/3] Add a |source| argument to inline behavior algorithm To support hash-based whitelisting of inline event handlers, CSP has added a |source| argument to the "Should |element|'s inline behavior be blocked by Content Security Policy?" (in w3c/webappsec#13). This patch adds the same argument to the four callsites in HTML. --- source | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/source b/source index 6df46b518ea..a7239055cb8 100644 --- a/source +++ b/source @@ -11343,9 +11343,9 @@ Transport Protocol">HTTP</abbr> today.</p>

  • If the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the - style element and "style", then abort these steps. + style element, "style", and the value of the + style element's textContent IDL attribute, then abort these steps.

    • @@ -58629,9 +58630,9 @@ o............A....e

  • If the script element does not have a src content attribute, and the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the script element and "script", then abort these steps. The script is not executed.

    • + data-x="">Blocked" when executed upon the script element, "script", and the value of the script element's text + IDL attribute, then abort these steps. The script is not executed.

  • @@ -88425,8 +88426,8 @@ dictionary PromiseRejectionEventInit : EventInit {

    1. If the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the - attribute's element and "script attribute", then abort these - steps.

      2. + attribute's element, "script attribute", and the attribute's + value, then abort these steps.

    2. Set the corresponding event handler to an internal raw uncompiled handler consisting of the attribute's new value and the From e7f4b4dc8d3770a28bb29318b919e11953205406 Mon Sep 17 00:00:00 2001 From: Mike West Date: Thu, 14 Apr 2016 15:40:30 +0200 Subject: [PATCH 2/3] fixup 'child text content' --- source | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source b/source index a7239055cb8..3c45ce878da 100644 --- a/source +++ b/source @@ -13862,7 +13862,7 @@ own thing rather than part of the extended sentence -->

    3. If the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the style element, "style", and the value of the - style element's textContent IDL attribute, then abort these steps. + style element's child text content, then abort these steps.

      4. @@ -58631,8 +58631,8 @@ o............A....e data-x="attr-script-src">src content attribute, and the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the script element, "script", and the value of the script element's text - IDL attribute, then abort these steps. The script is not executed.

      + data-x="">script", and the value of the script element's child text + content, then abort these steps. The script is not executed.

    4. From b4870ac3f17f4b87ef9d687b5f83465e8ecbcc83 Mon Sep 17 00:00:00 2001 From: Mike West Date: Thu, 14 Apr 2016 15:43:40 +0200 Subject: [PATCH 3/3] fixup 'style data' and slight cleanup. --- source | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/source b/source index 3c45ce878da..f72cf3d1236 100644 --- a/source +++ b/source @@ -13861,9 +13861,8 @@ own thing rather than part of the extended sentence -->

    5. If the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the - style element, "style", and the value of the - style element's child text content, then abort these steps. -

      6. + style element, "style", and the style + element's style data, then abort these steps.

      @@ -58631,8 +58630,8 @@ o............A....e data-x="attr-script-src">src content attribute, and the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the script element, "script", and the value of the script element's child text - content, then abort these steps. The script is not executed.

      + data-x="">script", and the script element's child text content, + then abort these steps. The script is not executed.