Apply `strict-dynamic` to inline scripts. (#787) · w3c/webappsec-csp@13c7d8e - 惯性聚合

推荐订阅源

Security @ Cisco Blogs

Proofpoint News Feed

Cisco Talos Blog

Darknet – Hacking Tools, Hacker News & Cyber Security

Cyber Attacks, Cyber Crime and Cyber Security

Tor Project blog

WordPress大学

Schneier on Security

Proofpoint News Feed

Privacy International News Feed

美团技术团队

Know Your Adversary

Java Code Geeks

奇客Solidot–传递最新科技情报

The Register - Security

Netflix TechBlog - Medium

Microsoft Security Blog

Engineering at Meta

博客园 - 三生石上(FineUI控件)

DataBreaches.Net

Threat Intelligence Blog | Flashpoint

Privacy & Cybersecurity Law Blog

Cybersecurity and Infrastructure Security Agency CISA

The Blog of Author Tim Ferriss

Kaspersky official blog

LINUX DO - 热门话题

Simon Willison's Weblog

Fortinet All Blogs

Threat Research - Cisco Blogs

Stack Overflow Blog

Help Net Security

Y Combinator Blog

宝玉的分享

CTFtime.org: upcoming CTF events

Recent Commits to webappsec-csp:main

[Editorial] Compare origins with 'same origin', not 'is'. · w3c/webappsec-csp@4e01ae7 Fixing 'policy' local link text. · w3c/webappsec-csp@0051d16 Fixing status. · w3c/webappsec-csp@b1de5f1 Export a dfn. · w3c/webappsec-csp@e156259 [Editorial] 'policy' is a local term, not global. (#812) · w3c/webappsec-csp@3e24aea Add "text" destination type, for JavaScript text imports · w3c/webappsec-csp@7845c09 Attach self-origin to CSP list (#805) · w3c/webappsec-csp@3a5e595 Fix algorithms called with missing parameters (#806) · w3c/webappsec-csp@a20d8fb [Editorial] Avoid nested parenthetical (#804) · w3c/webappsec-csp@8df1f5d Add 'unsafe-webtransport-hashes' keyword to connect-src (#791) · w3c/webappsec-csp@1b8a543 Add missing closing tag for section (#800) · w3c/webappsec-csp@5bc6639 [Editorial] Fix broken references to Trusted Types spec (#790) · w3c/webappsec-csp@a131bcb [Editorial] Reference the algorithm instead of the section for parse-… · w3c/webappsec-csp@9dd7cf1 [Editorial] Fix reference to parse-metadata in SRI (#777) · w3c/webappsec-csp@1137e96 Fix path matching in match-url-to-source-expression (#773) · w3c/webappsec-csp@97e4a82 Change CSPViolationReportBody to dictionary (#737) · w3c/webappsec-csp@a441899 Further clarify post-request check (#730) · w3c/webappsec-csp@7690298 Fix URL in report-uri request (#731) · w3c/webappsec-csp@5c12cbb [Editorial] Fix missing input param of match-response-source-list (#732) · w3c/webappsec-csp@7092cef

Apply `strict-dynamic` to inline scripts. (#787) · w3c/webappsec-csp@13c7d8e

mikewest · 2025-10-29 · via Recent Commits to webappsec-csp:main

Original file line number	Diff line number	Diff line change
`@@ -4412,6 +4412,10 @@ Content-Type: application/reports+json`
`4412`	`4412`
`4413`	`4413`	`2. <a for=set>For each</a> \|expression\| of \|list\|:`
`4414`	`4414`
	`4415`	+ 1. If \|expression\| is the "<a grammar>`'strict-dynamic'`</a>" <a grammar>keyword-source</a>:
	`4416`	`+`
	`4417`	+ 1. If \|type\| is "`script`", and \|element\| is not [=parser-inserted=], return "`Matches`".
	`4418`	`+`
`4415`	`4419`	1. If \|expression\| matches the <a grammar>`hash-source`</a> grammar:
`4416`	`4420`
`4417`	`4421`	`1. Let \|algorithm\| be null.`
`@@ -4448,8 +4452,6 @@ Content-Type: application/reports+json`
`4448`	`4452`	they will also apply to event handlers, style attributes and `javascript:`
`4449`	`4453`	`navigations.`
`4450`	`4454`
`4451`		- ISSUE(w3c/webappsec-csp#426): This should handle `'strict-dynamic'` for dynamically inserted inline scripts.
`4452`		`-`
`4453`	`4455`	6. Return "`Does Not Match`".
`4454`	`4456`
`4455`	`4457`	`<h3 id="directive-algorithms">Directive Algorithms</h3>`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。