26081 2014-06-13 06:25:39 +0000 Consider defining or mentioning the nonce attribute 2015-08-30 01:40:30 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED MOVED https://github.com/whatwg/html/pull/49 http://www.whatwg.org/specs/web-apps/current-work/#the-style-element P3 normal 2020 Q1 1 contributor ian annevk dveditz hillbrad ian mike mkwst w3c contributor oldest_to_newest 107768 0 contributor 2014-06-13 06:25:39 +0000 Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/semantics.html Multipage: http://www.whatwg.org/C#the-style-element Complete: http://www.whatwg.org/c#the-style-element Referrer: http://www.whatwg.org/specs/web-apps/current-work/multipage/ Comment: Consider defining or mentioning the nonce attribute Posted from: 77.57.114.66 by annevk@annevk.nl User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:33.0) Gecko/20100101 Firefox/33.0 107769 1 annevk 2014-06-13 06:26:46 +0000 It's in https://w3c.github.io/webappsec/specs/content-security-policy/#script-src-the-nonce-attribute on <style> and <script>. Having HTML attributes defined in HTML seems better. We should at least keep a complete list somewhere outside of browsers. 107794 2 ian 2014-06-13 18:31:32 +0000 what are the authoring and UA conformance requirements? 109630 3 annevk 2014-07-31 07:38:19 +0000 I'm not sure. Just trying to keep the list of HTML attributes we support in a single place. Mike or Daniel should know. 109666 4 dveditz 2014-07-31 15:04:01 +0000 Could it be defined by external reference to the CSP spec? I agree it would help authors to have a complete list of attributes in one place but I don't think we want duplicate definitions. 109671 5 ian 2014-07-31 15:29:57 +0000 The definition should only be in one place, certainly. 109672 6 mkwst 2014-07-31 15:31:33 +0000 It's currently defined at http://www.w3.org/TR/CSP2/#script-src-the-nonce-attribute What should we add to that to make the requirements clear? 109723 7 ian 2014-07-31 23:20:03 +0000 Pointing to that is probably sufficient, though maybe we should move the IDL stuff from CSP to HTML entirely, since that's not really what CSP is about anyway. 111208 8 ian 2014-09-08 22:58:43 +0000 Looking at this more closely, I realise that this integrates pretty closely with the <script> processing algorithm. It seems like the right solution here would be to put the logic in the HTML spec, and have the CSP spec provide a hook by which the nonce and hash values can be obtained for checking. Is that a plausible plan? 111241 9 mkwst 2014-09-09 09:13:56 +0000 (In reply to Ian 'Hixie' Hickson from comment #8) > Looking at this more closely, I realise that this integrates pretty closely > with the <script> processing algorithm. It seems like the right solution > here would be to put the logic in the HTML spec, and have the CSP spec > provide a hook by which the nonce and hash values can be obtained for > checking. Is that a plausible plan? Sure. Happy to make that change in the CSP spec. 111242 10 mkwst 2014-09-09 09:14:44 +0000 Sorry, hit submit too quickly: what would you like such a hook to provide? Just a sequence of string values you could compare against? 111274 11 ian 2014-09-09 15:55:14 +0000 Yeah, probably. There's no attempt to map specific elements to specific strings right? There's just a list of nonces and a list of hashes? 111337 12 mkwst 2014-09-10 10:45:51 +0000 (In reply to Ian 'Hixie' Hickson from comment #11) > Yeah, probably. There's no attempt to map specific elements to specific > strings right? There's just a list of nonces and a list of hashes? I think you'll need the following: * Valid nonces for script * Valid nonces for style * Pairs of (algorithm, hash) for script * Pairs of (algorithm, hash) for style See https://w3c.github.io/webappsec/specs/content-security-policy/#source-list-valid-nonces and https://w3c.github.io/webappsec/specs/content-security-policy/#source-list-valid-hashes for the currently defined algorithms for nonces and hashes respectively. 112966 13 ian 2014-10-10 18:12:56 +0000 I think for now I'm going to punt on this. The way it's specified works, this would just be editorial. 114689 14 ian 2014-11-07 21:43:17 +0000 Let me know if there's an important reason to prioritise this earlier. 122899 15 mike 2015-08-30 01:40:30 +0000 Moved to https://github.com/whatwg/html/pull/49