Search results

Strict-Dynamic CSP doesn't prevent execution of parser inserted scripts via document.createRange().createContextualFragment

Status: Open.

#708 In w3c/webappsec-csp;

· andreituicu opened on Feb 26, 2025

"source file" lacks a real defintion

Status: Open.

#707 In w3c/webappsec-csp;

· evilpie opened on Feb 14, 2025

connect-src test suite allows multiple non-interopable implementations.

interopImplementations are not interoperable with each otherImplementations are not interoperable with each other

Status: Open.

#706 In w3c/webappsec-csp;

· lukewarlow opened on Jan 30, 2025

Clipping of violation’s sample to the 40 first characters

Status: Open.

#704 In w3c/webappsec-csp;

· fred-wang opened on Jan 23, 2025

How to specify 2 endpoints for Reporting-Endpoints?

metaTasks and questions outside the content of the standardTasks and questions outside the content of the standard

Status: Open.

#701 In w3c/webappsec-csp;

· SwiftExtender opened on Jan 15, 2025

How to prevent an iframe with srcdoc and defined csp from inheriting the parent page's CSP policies

wontfixThis proposal or request will not be implementedThis proposal or request will not be implemented

Status: Open.

#700 In w3c/webappsec-csp;

· JuanRojasC opened on Dec 7, 2024

EnsureCSPDoesNotBlockStringCompilation: calling "Get Trusted Type compliant string"

editorialChanges that do not affect how the standard is understoodChanges that do not affect how the standard is understood

Status: Open.

#698 In w3c/webappsec-csp;

· fred-wang opened on Dec 4, 2024

EnsureCSPDoesNotBlockStringCompilation: Explain why we need to check TrustedScript's data (and add tests)

Status: Open.

#697 In w3c/webappsec-csp;

· fred-wang opened on Dec 4, 2024

https://w3c.github.io/webappsec-csp/#report-violation invokes "Queue a task" without passing a task source

Status: Open.

#696 In w3c/webappsec-csp;

· mbrodesser-Igalia opened on Dec 2, 2024

Allow RFC3986 scheme relative URIs in host-source

Status: Open.

#694 In w3c/webappsec-csp;

· Mahoney opened on Nov 27, 2024

Consider recommending the usage of events instead of CSP reports for CSP WPTs

editorialChanges that do not affect how the standard is understoodChanges that do not affect how the standard is understood

Status: Open.

#690 In w3c/webappsec-csp;

· mbrodesser-Igalia opened on Nov 19, 2024

Should "Should navigation request of type be blocked by Content Security Policy?" set the violation object's element?

clarificationThe standard is unclear or ambiguousThe standard is unclear or ambiguous

editorialChanges that do not affect how the standard is understoodChanges that do not affect how the standard is understood

Status: Open.

#687 In w3c/webappsec-csp;

· mbrodesser-Igalia opened on Oct 24, 2024