Skip to content

Commit 6938eb9

Browse files
annevkannevk
committed
Meta: align with Fetch
Network scheme is now reduced to HTTP(S) scheme and request's keepalive flag was renamed to keepalive. See whatwg/fetch#1166 for context.
1 parent 483800d commit 6938eb9

2 files changed

Lines changed: 27 additions & 28 deletions

File tree

‎index.html‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1321,9 +1321,9 @@
13211321
}
13221322
}
13231323
</style>
1324-
<meta content="Bikeshed version eb6d17d1, updated Tue Oct 20 23:26:51 2020 -0700" name="generator">
1324+
<meta content="Bikeshed version 89ebb6ab, updated Fri Oct 9 15:32:07 2020 -0700" name="generator">
13251325
<link href="https://www.w3.org/TR/CSP3/" rel="canonical">
1326-
<meta content="9a4070d6a19b99e7a10e1864906794d0f9002b29" name="document-revision">
1326+
<meta content="483800de36fc72f4184c71b8576109a14311dd83" name="document-revision">
13271327
<style>
13281328
ul.toc ul ul ul {
13291329
margin: 0 0 0 2em;
@@ -1920,7 +1920,7 @@
19201920
<div class="head">
19211921
<p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2016/logos/W3C" width="72"> </a> </p>
19221922
<h1>Content Security Policy Level 3</h1>
1923-
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2021-01-11">11 January 2021</time></span></h2>
1923+
<h2 class="no-num no-toc no-ref heading settled" id="subtitle"><span class="content">Editor’s Draft, <time class="dt-updated" datetime="2021-02-10">10 February 2021</time></span></h2>
19241924
<div data-fill-with="spec-metadata">
19251925
<dl>
19261926
<dt>This version:
@@ -2424,8 +2424,8 @@ <h3 class="heading settled" data-level="1.3" id="changes-from-level-2"><span cla
24242424
hashes. Details in <a href="#unsafe-hashes-usage">§ 8.3 Usage of "'unsafe-hashes'"</a>.</p>
24252425
<li data-md>
24262426
<p>The <a data-link-type="dfn" href="#source-expression" id="ref-for-source-expression">source expression</a> matching has been changed to require explicit presence
2427-
of any non-<a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#network-scheme" id="ref-for-network-scheme">network scheme</a>, rather than <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#local-scheme" id="ref-for-local-scheme">local scheme</a>,
2428-
unless that non-<a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#network-scheme" id="ref-for-network-scheme①">network scheme</a> is the same as the scheme of protected resource,
2427+
of any non-<a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#http-scheme" id="ref-for-http-scheme">HTTP(S) scheme</a>, rather than <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#local-scheme" id="ref-for-local-scheme">local scheme</a>,
2428+
unless that non-<a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#http-scheme" id="ref-for-http-scheme①">HTTP(S) scheme</a> is the same as the scheme of protected resource,
24292429
as described in <a href="#match-url-to-source-expression">§ 6.6.2.6 Does url match expression in origin with redirect count?</a>.</p>
24302430
<li data-md>
24312431
<p>Hash-based source expressions may now match external scripts if the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/scripting.html#script" id="ref-for-script①">script</a></code> element that triggers the request specifies a set of integrity
@@ -3602,7 +3602,7 @@ <h3 class="heading settled algorithm" data-algorithm="Report a violation" data-l
36023602
<dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode">credentials mode</a>
36033603
<dd data-md>
36043604
<p>"<code>same-origin</code>"</p>
3605-
<dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#request-keepalive-flag" id="ref-for-request-keepalive-flag">keepalive flag</a>
3605+
<dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#request-keepalive-flag" id="ref-for-request-keepalive-flag">keepalive</a>
36063606
<dd data-md>
36073607
<p>"<code>true</code>"</p>
36083608
<dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list">header list</a>
@@ -5225,11 +5225,11 @@ <h5 class="heading settled algorithm" data-algorithm="Does url match expression
52255225
the following conditions is met:</p>
52265226
<ol>
52275227
<li data-md>
5228-
<p><var>url</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme③">scheme</a> is a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#network-scheme" id="ref-for-network-scheme②">network scheme</a>.</p>
5228+
<p><var>url</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme③">scheme</a> is an <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#http-scheme" id="ref-for-http-scheme②">HTTP(S) scheme</a>.</p>
52295229
<li data-md>
52305230
<p><var>url</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme④">scheme</a> is the same as <var>origin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-scheme" id="ref-for-concept-origin-scheme">scheme</a>.</p>
52315231
</ol>
5232-
<p class="note" role="note"><span>Note:</span> This logic means that in order to allow a resource from a non-<a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#network-scheme" id="ref-for-network-scheme③">network scheme</a>,
5232+
<p class="note" role="note"><span>Note:</span> This logic means that in order to allow a resource from a non-<a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#http-scheme" id="ref-for-http-scheme③">HTTP(S) scheme</a>,
52335233
it has to be either explicitly specified (e.g. <code>default-src * data: custom-scheme-1: custom-scheme-2:</code>),
52345234
or the protected resource must be loaded from the same scheme.</p>
52355235
<li data-md>
@@ -6875,6 +6875,14 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
68756875
Integration with Fetch </a> <a href="#ref-for-concept-http-fetch①">(2)</a>
68766876
</ul>
68776877
</aside>
6878+
<aside class="dfn-panel" data-for="term-for-http-scheme">
6879+
<a href="https://fetch.spec.whatwg.org/#http-scheme">https://fetch.spec.whatwg.org/#http-scheme</a><b>Referenced in:</b>
6880+
<ul>
6881+
<li><a href="#ref-for-http-scheme">1.3. Changes from Level 2</a> <a href="#ref-for-http-scheme①">(2)</a>
6882+
<li><a href="#ref-for-http-scheme②">6.6.2.6.
6883+
Does url match expression in origin with redirect count? </a> <a href="#ref-for-http-scheme③">(2)</a>
6884+
</ul>
6885+
</aside>
68786886
<aside class="dfn-panel" data-for="term-for-concept-http-network-fetch">
68796887
<a href="https://fetch.spec.whatwg.org/#concept-http-network-fetch">https://fetch.spec.whatwg.org/#concept-http-network-fetch</a><b>Referenced in:</b>
68806888
<ul>
@@ -6946,14 +6954,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
69466954
Integration with Fetch </a>
69476955
</ul>
69486956
</aside>
6949-
<aside class="dfn-panel" data-for="term-for-network-scheme">
6950-
<a href="https://fetch.spec.whatwg.org/#network-scheme">https://fetch.spec.whatwg.org/#network-scheme</a><b>Referenced in:</b>
6951-
<ul>
6952-
<li><a href="#ref-for-network-scheme">1.3. Changes from Level 2</a> <a href="#ref-for-network-scheme①">(2)</a>
6953-
<li><a href="#ref-for-network-scheme②">6.6.2.6.
6954-
Does url match expression in origin with redirect count? </a> <a href="#ref-for-network-scheme③">(2)</a>
6955-
</ul>
6956-
</aside>
69576957
<aside class="dfn-panel" data-for="term-for-concept-request-origin">
69586958
<a href="https://fetch.spec.whatwg.org/#concept-request-origin">https://fetch.spec.whatwg.org/#concept-request-origin</a><b>Referenced in:</b>
69596959
<ul>
@@ -8358,16 +8358,16 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
83588358
<li><span class="dfn-paneled" id="term-for-concept-fetch">fetch</span>
83598359
<li><span class="dfn-paneled" id="term-for-concept-response-header-list">header list <small>(for response)</small></span>
83608360
<li><span class="dfn-paneled" id="term-for-concept-http-fetch">http fetch</span>
8361+
<li><span class="dfn-paneled" id="term-for-http-scheme">http(s) scheme</span>
83618362
<li><span class="dfn-paneled" id="term-for-concept-http-network-fetch">http-network fetch</span>
83628363
<li><span class="dfn-paneled" id="term-for-concept-request-initiator">initiator</span>
83638364
<li><span class="dfn-paneled" id="term-for-concept-request-integrity-metadata">integrity metadata</span>
8364-
<li><span class="dfn-paneled" id="term-for-request-keepalive-flag">keepalive flag</span>
8365+
<li><span class="dfn-paneled" id="term-for-request-keepalive-flag">keepalive</span>
83658366
<li><span class="dfn-paneled" id="term-for-local-scheme">local scheme</span>
83668367
<li><span class="dfn-paneled" id="term-for-concept-main-fetch">main fetch</span>
83678368
<li><span class="dfn-paneled" id="term-for-concept-request-method">method</span>
83688369
<li><span class="dfn-paneled" id="term-for-concept-request-mode">mode</span>
83698370
<li><span class="dfn-paneled" id="term-for-concept-network-error">network error</span>
8370-
<li><span class="dfn-paneled" id="term-for-network-scheme">network scheme</span>
83718371
<li><span class="dfn-paneled" id="term-for-concept-request-origin">origin</span>
83728372
<li><span class="dfn-paneled" id="term-for-concept-request-parser-metadata">parser metadata</span>
83738373
<li><span class="dfn-paneled" id="term-for-concept-request-redirect-count">redirect count</span>
@@ -8574,7 +8574,7 @@ <h2 class="no-num no-ref heading settled" id="references"><span class="content">
85748574
<h3 class="no-num no-ref heading settled" id="normative"><span class="content">Normative References</span><a class="self-link" href="#normative"></a></h3>
85758575
<dl>
85768576
<dt id="biblio-css-cascade-5">[CSS-CASCADE-5]
8577-
<dd>CSS Cascading and Inheritance Level 5 URL: <a href="https://www.w3.org/TR/css-cascade-5/">https://www.w3.org/TR/css-cascade-5/</a>
8577+
<dd>Elika Etemad; Miriam Suzanne; Tab Atkins Jr.. <a href="https://www.w3.org/TR/css-cascade-5/">CSS Cascading and Inheritance Level 5</a>. 19 January 2021. WD. URL: <a href="https://www.w3.org/TR/css-cascade-5/">https://www.w3.org/TR/css-cascade-5/</a>
85788578
<dt id="biblio-cssom">[CSSOM]
85798579
<dd>Simon Pieters; Glenn Adams. <a href="https://www.w3.org/TR/cssom-1/">CSS Object Model (CSSOM)</a>. 17 March 2016. WD. URL: <a href="https://www.w3.org/TR/cssom-1/">https://www.w3.org/TR/cssom-1/</a>
85808580
<dt id="biblio-dom">[DOM]
@@ -8633,15 +8633,15 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
86338633
<h3 class="no-num no-ref heading settled" id="informative"><span class="content">Informative References</span><a class="self-link" href="#informative"></a></h3>
86348634
<dl>
86358635
<dt id="biblio-appmanifest">[APPMANIFEST]
8636-
<dd>Marcos Caceres; et al. <a href="https://www.w3.org/TR/appmanifest/">Web App Manifest</a>. 19 October 2020. WD. URL: <a href="https://www.w3.org/TR/appmanifest/">https://www.w3.org/TR/appmanifest/</a>
8636+
<dd>Marcos Caceres; et al. <a href="https://www.w3.org/TR/appmanifest/">Web App Manifest</a>. 22 January 2021. WD. URL: <a href="https://www.w3.org/TR/appmanifest/">https://www.w3.org/TR/appmanifest/</a>
86378637
<dt id="biblio-beacon">[BEACON]
86388638
<dd>Ilya Grigorik; et al. <a href="https://www.w3.org/TR/beacon/">Beacon</a>. 13 April 2017. CR. URL: <a href="https://www.w3.org/TR/beacon/">https://www.w3.org/TR/beacon/</a>
86398639
<dt id="biblio-csp2">[CSP2]
86408640
<dd>Mike West; Adam Barth; Daniel Veditz. <a href="https://www.w3.org/TR/CSP2/">Content Security Policy Level 2</a>. 15 December 2016. REC. URL: <a href="https://www.w3.org/TR/CSP2/">https://www.w3.org/TR/CSP2/</a>
86418641
<dt id="biblio-css-abuse">[CSS-ABUSE]
86428642
<dd>Chris Evans. <a href="https://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html">Generic cross-browser cross-domain theft</a>. 28 December 2009. URL: <a href="https://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html">https://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html</a>
86438643
<dt id="biblio-eventsource">[EVENTSOURCE]
8644-
<dd>Ian Hickson. <a href="https://www.w3.org/TR/eventsource/">Server-Sent Events</a>. 3 February 2015. REC. URL: <a href="https://www.w3.org/TR/eventsource/">https://www.w3.org/TR/eventsource/</a>
8644+
<dd>Ian Hickson. <a href="https://www.w3.org/TR/eventsource/">Server-Sent Events</a>. 28 January 2021. REC. URL: <a href="https://www.w3.org/TR/eventsource/">https://www.w3.org/TR/eventsource/</a>
86458645
<dt id="biblio-filedescriptor-2015">[FILEDESCRIPTOR-2015]
86468646
<dd>filedescriptor. <a href="https://blog.innerht.ml/csp-2015/#danglingmarkupinjection">CSP 2015</a>. 23 November 2015. URL: <a href="https://blog.innerht.ml/csp-2015/#danglingmarkupinjection">https://blog.innerht.ml/csp-2015/#danglingmarkupinjection</a>
86478647
<dt id="biblio-h5sc3">[H5SC3]
@@ -8657,7 +8657,7 @@ <h3 class="no-num no-ref heading settled" id="informative"><span class="content"
86578657
<dt id="biblio-upgrade-insecure-requests">[UPGRADE-INSECURE-REQUESTS]
86588658
<dd>Mike West. <a href="https://www.w3.org/TR/upgrade-insecure-requests/">Upgrade Insecure Requests</a>. 8 October 2015. CR. URL: <a href="https://www.w3.org/TR/upgrade-insecure-requests/">https://www.w3.org/TR/upgrade-insecure-requests/</a>
86598659
<dt id="biblio-websockets">[WEBSOCKETS]
8660-
<dd>Ian Hickson. <a href="https://www.w3.org/TR/websockets/">The WebSocket API</a>. 20 September 2012. CR. URL: <a href="https://www.w3.org/TR/websockets/">https://www.w3.org/TR/websockets/</a>
8660+
<dd>Ian Hickson. <a href="https://www.w3.org/TR/websockets/">The WebSocket API</a>. 28 January 2021. NOTE. URL: <a href="https://www.w3.org/TR/websockets/">https://www.w3.org/TR/websockets/</a>
86618661
<dt id="biblio-xhr">[XHR]
86628662
<dd>Anne van Kesteren. <a href="https://xhr.spec.whatwg.org/">XMLHttpRequest Standard</a>. Living Standard. URL: <a href="https://xhr.spec.whatwg.org/">https://xhr.spec.whatwg.org/</a>
86638663
<dt id="biblio-xslt">[XSLT]

‎index.src.html‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ <h1>Content Security Policy Level 3</h1>
4343
text: main fetch
4444
text: http-network fetch
4545
text: http fetch
46-
text: keepalive flag
4746
text: response; for: /
4847
spec:url
4948
type: dfn
@@ -347,8 +346,8 @@ <h3 id="changes-from-level-2">Changes from Level 2</h3>
347346
hashes. Details in [[#unsafe-hashes-usage]].
348347

349348
9. The <a>source expression</a> matching has been changed to require explicit presence
350-
of any non-<a>network scheme</a>, rather than <a>local scheme</a>,
351-
unless that non-<a>network scheme</a> is the same as the scheme of protected resource,
349+
of any non-<a>HTTP(S) scheme</a>, rather than <a>local scheme</a>,
350+
unless that non-<a>HTTP(S) scheme</a> is the same as the scheme of protected resource,
352351
as described in [[#match-url-to-source-expression]].
353352

354353
10. Hash-based source expressions may now match external scripts if the
@@ -1833,7 +1832,7 @@ <h3 id="report-violation" algorithm>
18331832
:: ""
18341833
: <a for="request">credentials mode</a>
18351834
:: "`same-origin`"
1836-
: <a for="request">keepalive flag</a>
1835+
: <a for="request">keepalive</a>
18371836
:: "`true`"
18381837
: <a for="request">header list</a>
18391838
:: A header list containing a single header whose name is
@@ -4085,11 +4084,11 @@ <h5 id="match-url-to-source-expression" algorithm>
40854084
1. If |expression| is the string "*", return "`Matches`" if one or more of
40864085
the following conditions is met:
40874086

4088-
1. |url|'s <a for="url">scheme</a> is a <a>network scheme</a>.
4087+
1. |url|'s <a for="url">scheme</a> is an <a>HTTP(S) scheme</a>.
40894088

40904089
2. |url|'s <a for="url">scheme</a> is the same as |origin|'s <a for="origin">scheme</a>.
40914090

4092-
Note: This logic means that in order to allow a resource from a non-<a>network scheme</a>,
4091+
Note: This logic means that in order to allow a resource from a non-<a>HTTP(S) scheme</a>,
40934092
it has to be either explicitly specified (e.g.
40944093
`default-src * data: custom-scheme-1: custom-scheme-2:`),
40954094
or the protected resource must be loaded from the same scheme.

0 commit comments

Comments
 (0)