From ee3486eb129bc350b5ca684d0c91dff23453ac1a Mon Sep 17 00:00:00 2001 From: Mike West Date: Wed, 21 Oct 2015 14:48:42 +0200 Subject: [PATCH] Call out to CSP's inline element hooks Content Security Policy defines a "Should element's inline behavior be blocked by Content Security Policy?" algorithm in order to handle things like nonces, hashes, and 'unsafe-inline'. This patch adds those hooks to the appropriate spots in HTML's 'prepare a script' and 'update a style block' algorithms. whatwg/html#271 --- source | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/source b/source index dfe695001ea..0c23f9fcd16 100644 --- a/source +++ b/source @@ -3523,6 +3523,7 @@ a.setAttribute('href', 'http://example.com/'); // change the content attribute d
  • The parse a serialized Content Security Policy algorithm
  • The Initialise a global object's CSP list algorithm
  • The Initialise a Document's CSP list algorithm
    • +
  • The Should element's inline behavior be blocked by Content Security Policy? algorithm
  • The report-uri directive
  • The sandbox directive
    • @@ -13191,11 +13192,6 @@ people expect to have work and what is necessary. to determine whether or not the style specified by an element will be applied to the document. The value is text.

    -

    The processing model for the nonce attribute needs to be integrated into the update a - style block algorithm. The current definition in is fairly - vague. See w3c/webappsec#463.

    -

    The scoped attribute is a boolean attribute. If present, it indicates that the styles are intended just for the subtree rooted at the style element's parent element, as opposed to the whole @@ -13300,6 +13296,10 @@ own thing rather than part of the extended sentence -->

  • If element is not in a Document, then abort these steps.

    • +

  • If the Should element's inline behavior be blocked by Content Security + Policy? algorithm returns "Blocked" when executed upon the + style element, then abort these steps.

    • +
  • @@ -59252,11 +59252,6 @@ dictionary RelatedEventInit : EventInit { to determine whether or not the script specified by an element will be executed. The value is text.

    -

    The processing model for the nonce attribute needs to be integrated into the prepare a - script algorithm. The current definition in is fairly vague. See - w3c/webappsec#463.

    -

    Changing the src, type, charset, async, defer, RelatedEventInit : EventInit {

    • +

  • If the script element does not have a src content attribute, and the Should node's inline + behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the script element, then the user + agent must abort these steps. The script is not executed.

    • +

  • If the script element has an event