No CSP report-uri|frame-ancestors|sandbox in meta

[sideshowbarker]

Add a normative document-conformance (authoring) requirement that a Content Security Policy given in the value of the content attribute of a meta[http-equiv=content-security-policy] element must not contain any report-uri, frame-ancestors, or sandbox directives.

To help authors/developers avoid making the mistake of putting report-uri, frame-ancestors, or sandbox directives in meta—where UAs will just (silently) ignore them—the document-conformance (authoring) side of the spec’s CSP requirements should explicitly disallow those directives in meta.

Adding this to the spec also enables me to add a corresponding error message to the HTML checker.

cc @mikewest

[annevk]

You could wrap just before data-x here. Same for others.

[sideshowbarker]

You could wrap just before data-x here. Same for others.

OK—done in 745be2f

[sideshowbarker]

I'd like wrapping to occur where there would otherwise be spaces, so that it matches what my text editor's "hard wrap" feature does without manual tweaks.

Yeah, agreed. Too ugly and not consistent with what we've done so far :)

OK then, settled on this:

     attribute in the <span data-x="attr-meta-http-equiv-content-security-policy">Content security
     policy state</span>, the <code data-x="attr-meta-content">content</code> attribute must have a
     value consisting of a <span data-x="Content Security Policy syntax">valid Content Security
-    Policy</span>, which will be <span data-x="enforce the policy">enforced</span> upon the current
-    document. <ref spec="CSP"></p>
+    Policy</span>, but must not contain any <code data-x="report-uri directive">report-uri</code>,
+    <code data-x="frame-ancestors directive">frame-ancestors</code>, or <code data-x="sandbox
+    directive">sandbox</code> <span data-x="Content Security Policy directive">directives</span>.
+    The <span>Content Security Policy</span> given in the <code
+    data-x="attr-meta-content">content</code> attribute will be <span
+    data-x="enforce the policy">enforced</span> upon the current document. <ref spec="CSP"></p>

[annevk]

We are still waiting for @mikewest to review this? LGTM otherwise.

[sideshowbarker]

We are still waiting for @mikewest to review this?

Yeah—especially since it’s a normative change, don’t think it should be merged til he’s reviewed and OK’ed it.

[mikewest]

LGTM, sorry for the delay.

Note that I want to drop the restriction on sandbox (and Chrome willfully violates the spec at the moment), but the text you've written is otherwise spot on (and matches Firefox and Edge's behavior).