<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://www.w3.org/Bugs/Public/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4"
          urlbase="https://www.w3.org/Bugs/Public/"
          
          maintainer="sysbot+bugzilla@w3.org"
>

    <bug>
          <bug_id>27223</bug_id>
          
          <creation_ts>2014-11-03 19:47:52 +0000</creation_ts>
          <short_desc>Need clarification on JavaScript execution when Content Security Policy is in place</short_desc>
          <delta_ts>2014-11-03 19:47:52 +0000</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>Browser Test/Tools WG</product>
          <component>WebDriver</component>
          <version>unspecified</version>
          <rep_platform>PC</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>NEW</bug_status>
          <resolution></resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Jim Evans">james.h.evans.jr</reporter>
          <assigned_to name="Browser Testing and Tools WG">public-browser-tools-testing</assigned_to>
          <cc>mike</cc>
          
          <qa_contact name="Browser Testing and Tools WG">public-browser-tools-testing</qa_contact>

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>114437</commentid>
    <comment_count>0</comment_count>
    <who name="Jim Evans">james.h.evans.jr</who>
    <bug_when>2014-11-03 19:47:52 +0000</bug_when>
    <thetext>If a page has a Content Security Policy applied (spec: https://w3c.github.io/webappsec/specs/content-security-policy/), it may prevent the execution of user-supplied JavaScript via the executeScript command. This is because the injected JavaScript would have no source which could be validated by the policy. The WebDriver spec should have language describing how a driver should behave in this event.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>