Web Application Security Working Group - Activity in 2018
No matches.
Participants
-
1 organization joined.
-
Alibaba Group joined.
-
GitHub
w3c/permissions
-
1 issue opened.
-
Update on 'read' and 'write' methods? w3c/permissions#187, by @zqillini4.
-
-
1 issue closed.
-
Update on 'read' and 'write' methods? w3c/permissions#187.
-
-
2 issues received 3 new comments.
-
1 pull request opened.
-
Rename 'display' permission to 'display-capture'. w3c/permissions#188, by @jan-ivar.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
3 issues opened.
-
Include script hash in CSP report when 'report-sample' is set w3c/webappsec-csp#378, by @april.
-
parser_inserted flag used in 'strict-dynamic' check is not sufficient w3c/webappsec-csp#376, by @andypaicu.
-
Choose a consistent model for workers under nonce-based policies w3c/webappsec-csp#375, by @arturjanc.
-
-
3 issues closed.
-
Bug in directive-value grammar w3c/webappsec-csp#366.
-
Make CSP inheritance for javascript: more explicit w3c/webappsec-csp#368.
-
Initialize document CSP in html needs to be updated w3c/webappsec-csp#364.
-
-
4 issues received 17 new comments.
-
Choose a consistent model for workers under nonce-based policies w3c/webappsec-csp#375 (7 comments by @andypaicu, @annevk, @arturjanc)
-
parser_inserted flag used in 'strict-dynamic' check is not sufficient w3c/webappsec-csp#376 (1 comment by @domenic)
-
-
4 pull requests opened.
-
Move prefetch-src after object-src in the fetch directives. w3c/webappsec-csp#379, by @april.
-
Use the duplicate attribute flag is nonceable check w3c/webappsec-csp#377, by @andypaicu.
-
Allow plugin-types to be empty w3c/webappsec-csp#374, by @andypaicu.
-
Removed w3c/html related issues w3c/webappsec-csp#373, by @andypaicu.
-
-
5 pull requests merged.
-
Move prefetch-src after object-src in the fetch directives. w3c/webappsec-csp#379.
-
Allow plugin-types to be empty w3c/webappsec-csp#374.
-
Added javascript: scheme specifically and fixed a small comment w3c/webappsec-csp#370.
-
Handle a null request in init document csp algorithm w3c/webappsec-csp#372.
-
Removed w3c/html related issues w3c/webappsec-csp#373.
-
-
2 pull requests received 2 new comments.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
The design fails to make a secure guarantee w3c/webappsec-subresource-integrity#80, by @douglasheld.
-
-
3 issues received 9 new comments.
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20 (5 comments by @devd, @mikewest, @mozfreddyb, @ScottHelme)
-
The design fails to make a secure guarantee w3c/webappsec-subresource-integrity#80 (3 comments by @dveditz, @mozfreddyb)
-
w3c/webappsec
-
5 issues closed.
-
Way to disown window.opener and become a secure context w3c/webappsec#517.
-
Referrer attribute and Fetch integration w3c/webappsec#409.
-
Mixed Content: fetch() in service workers broken w3c/webappsec#415.
-
POWER: IDL syntax? w3c/webappsec#262.
-
[csp] References are out of date w3c/webappsec#22.
-
-
6 issues received 6 new comments.
-
4 pull requests opened.
-
Updated the page title to 2019 w3c/webappsec#542, by @Dilski.
-
update link to Feature Policy w3c/webappsec#541, by @wseltzer.
-
propose 2-year charter w3c/webappsec#540, by @wseltzer.
-
Add Feature Policy to deliverables w3c/webappsec#539, by @wseltzer.
-
-
3 pull requests merged.
-
update link to Feature Policy w3c/webappsec#541.
-
propose 2-year charter w3c/webappsec#540.
-
Add Feature Policy to deliverables w3c/webappsec#539.
-
-
1 pull request closed.
-
CSP3: message-src message-sink w3c/webappsec#161.
-
-
1 pull request received 3 new comments.
w3c/webappsec-permissions-policy
-
5 issues opened.
-
Broken link in the repo's description w3c/webappsec-permissions-policy#265, by @dandv.
-
Feature Policy to Enforce/Avoid Feature Policy Propagation to Auxiliary Contexts w3c/webappsec-permissions-policy#264, by @ehsan-karamad.
-
Remove 'vibrate' feature from examples in spec w3c/webappsec-permissions-policy#263, by @jpchase.
-
[Proposal] Accessibility policy w3c/webappsec-permissions-policy#261, by @tdresser.
-
export anchor terms for algorithms w3c/webappsec-permissions-policy#260, by @frivoal.
-
-
3 issues closed.
-
Broken link in the repo's description w3c/webappsec-permissions-policy#265.
-
Remove 'vibrate' feature from examples in spec w3c/webappsec-permissions-policy#263.
-
Rename document.policy to document.featurePolicy w3c/webappsec-permissions-policy#216.
-
-
7 issues received 12 new comments.
-
Broken link in the repo's description w3c/webappsec-permissions-policy#265 (3 comments by @clelland, @wseltzer)
-
Rename document.policy to document.featurePolicy w3c/webappsec-permissions-policy#216 (3 comments by @ckerschb, @clelland)
-
Feature Proposal: disallow-animated-gif w3c/webappsec-permissions-policy#137 (1 comment by @ehsan-karamad)
-
-
2 pull requests opened.
-
Update to point to the w3c org w3c/webappsec-permissions-policy#266, by @wseltzer.
-
Update JS api w3c/webappsec-permissions-policy#262, by @clelland.
-
-
2 pull requests merged.
-
Update to point to the w3c org w3c/webappsec-permissions-policy#266.
-
Update JS api w3c/webappsec-permissions-policy#262.
-
-
2 pull requests received 3 new comments.
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#259 (2 comments by @ehsan-karamad)
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220 (1 comment by @eeeps)
-
w3c/webcrypto
-
1 issue opened.
-
UUID generation as part of crypto.subtle? w3c/webcrypto#215, by @littledan.
-
-
2 issues received 2 new comments.
-
1 pull request opened.
-
Fix readme w3c/webcrypto#214, by @orubin.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Consider "potentially trustworthy" for responses w3c/webappsec-secure-contexts#63, by @jyasskin.
-
w3c/webappsec-fetch-metadata
-
2 issues opened.
-
More descriptive header names for `destination` and `user-activated` w3c/webappsec-fetch-metadata#9, by @arturjanc.
-
Change "?F" and "?T" in `Sec-Fetch-User` w3c/webappsec-fetch-metadata#8, by @arturjanc.
-
-
3 issues closed.
-
Change "?F" and "?T" in `Sec-Fetch-User` w3c/webappsec-fetch-metadata#8.
-
Expose the request's `mode' value w3c/webappsec-fetch-metadata#5.
-
Separate headers w3c/webappsec-fetch-metadata#6.
-
-
2 issues received 5 new comments.
-
Change "?F" and "?T" in `Sec-Fetch-User` w3c/webappsec-fetch-metadata#8 (3 comments by @arturjanc, @mikewest, @mnot)
-
More descriptive header names for `destination` and `user-activated` w3c/webappsec-fetch-metadata#9 (2 comments by @arturjanc, @mikewest)
-
-
1 pull request opened.
-
Update `site' value in the example to `cross-site` w3c/webappsec-fetch-metadata#7, by @arturjanc.
-
-
1 pull request merged.
-
Update `site' value in the example to `cross-site` w3c/webappsec-fetch-metadata#7.
-
w3c/webappsec-change-password-url
-
6 issues opened.
-
Adopt pr-preview w3c/webappsec-change-password-url#11, by @hober.
-
Add a parameter to specify a language version of the app w3c/webappsec-change-password-url#10, by @davidkmenta.
-
Clarify interpretation of RFC5785 §1.1 w3c/webappsec-change-password-url#9, by @hober.
-
Consider restricting the target of the redirect to be same-origin w3c/webappsec-change-password-url#8, by @hober.
-
What should clients do on OK status? w3c/webappsec-change-password-url#7, by @jgimenez.
-
base origin has multiple apps w3c/webappsec-change-password-url#6, by @jbtule.
-
-
5 issues closed.
-
Adopt pr-preview w3c/webappsec-change-password-url#11.
-
Add a parameter to specify a language version of the app w3c/webappsec-change-password-url#10.
-
Use RFC2119 to put constraints on actors doing $foo, not on things being $bar or having $baz w3c/webappsec-change-password-url#5.
-
Consider adding a bit more detail to the generation algorithm. w3c/webappsec-change-password-url#2.
-
base origin has multiple apps w3c/webappsec-change-password-url#6.
-
-
8 issues received 18 new comments.
-
base origin has multiple apps w3c/webappsec-change-password-url#6 (6 comments by @hober, @jbtule, @staabm, @tschoffelen)
-
Add informative text clarifying that servers may use complex logic to determine where to redirect to w3c/webappsec-change-password-url#4 (4 comments by @hober, @junderw, @leonklingele)
-
Use RFC2119 to put constraints on actors doing $foo, not on things being $bar or having $baz w3c/webappsec-change-password-url#5 (2 comments by @hober, @ItsShadowCone)
-
Add a parameter to specify a language version of the app w3c/webappsec-change-password-url#10 (1 comment by @hober)
-
Consider restricting the target of the redirect to be same-origin w3c/webappsec-change-password-url#8 (1 comment by @jbtule)
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
-
[Q] What happens when "executionContexts" is present along with Location header? w3c/webappsec-clear-site-data#56 (1 comment by @annevk)
-
w3c/trusted-types
-
1 issue received 12 new comments.
-
Facilitate creating trusted types from string literals w3c/trusted-types#96 (12 comments by @erights, @jridgewell, @koto, @littledan, @xtofian)
-
-
1 pull request opened.
-
Added support for WPT on OSX. Fixed the harness tests. w3c/trusted-types#99, by @koto.
-
-
1 pull request merged.
-
Added support for WPT on OSX. Fixed the harness tests. w3c/trusted-types#99.
-
w3c/webappsec-credential-management
-
2 issues closed.
-
#credential-internal-methods section is sort of confusing w3c/webappsec-credential-management#103.
-
add [=in parallel=] to credential internal methods w3c/webappsec-credential-management#105.
-
-
1 pull request opened.
-
Drop 'origin' from public interfaces after #100. w3c/webappsec-credential-management#131, by @mikewest.
-
-
1 pull request merged.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100.
-
Participants
-
1 participant left.
-
Jeff Hodges (Google LLC) left.
-
GitHub
w3c/webappsec-permissions-policy
-
12 issues opened.
-
Possible race in feature policy in multiprocess implementations w3c/webappsec-permissions-policy#256, by @bzbarsky.
-
Central list of policies w3c/webappsec-permissions-policy#255, by @craigfrancis.
-
Should document.domain setter be considered different than 'self' ? w3c/webappsec-permissions-policy#253, by @bakulf.
-
Define the scope of feature policy w3c/webappsec-permissions-policy#252, by @clelland.
-
What happened to the webrtc feature? w3c/webappsec-permissions-policy#250, by @danjenkins.
-
HTTP header fields w3c/webappsec-permissions-policy#249, by @martinthomson.
-
How to decide what is governed by feature policy w3c/webappsec-permissions-policy#248, by @martinthomson.
-
Remove the entire Integrations section (monkey patch) w3c/webappsec-permissions-policy#245, by @sideshowbarker.
-
Maintain a registry w3c/webappsec-permissions-policy#244, by @annevk.
-
What happened to "notifications"? w3c/webappsec-permissions-policy#243, by @annevk.
-
Very Hard to Read If Dark Theme is used with the dev tools w3c/webappsec-permissions-policy#242, by @eperret.
-
Proposal: Control over `document.domain` w3c/webappsec-permissions-policy#241, by @mikewest.
-
-
4 issues closed.
-
Remove allowusermedia w3c/webappsec-permissions-policy#228.
-
Central list of policies w3c/webappsec-permissions-policy#255.
-
Remove the entire Integrations section (monkey patch) w3c/webappsec-permissions-policy#245.
-
Proposal: Control over `document.domain` w3c/webappsec-permissions-policy#241.
-
-
17 issues received 60 new comments.
-
Define the scope of feature policy w3c/webappsec-permissions-policy#252 (11 comments by @annevk, @bzbarsky, @clelland, @martinthomson, @ojanvafai)
-
What happened to "notifications"? w3c/webappsec-permissions-policy#243 (9 comments by @annevk, @clelland, @johannhof, @martinthomson, @raymeskhoury)
-
Maintain a registry w3c/webappsec-permissions-policy#244 (7 comments by @annevk, @ojanvafai, @sideshowbarker)
-
Need to define how 'src' works with sandboxed frames w3c/webappsec-permissions-policy#230 (7 comments by @annevk, @bzbarsky, @clelland, @mikewest)
-
Possible race in feature policy in multiprocess implementations w3c/webappsec-permissions-policy#256 (4 comments by @annevk, @bzbarsky, @clelland)
-
Proposal: Control over `document.domain` w3c/webappsec-permissions-policy#241 (4 comments by @annevk, @clelland, @mikewest)
-
Should document.domain setter be considered different than 'self' ? w3c/webappsec-permissions-policy#253 (3 comments by @annevk, @bzbarsky, @clelland)
-
Delineate relationship between Feature Policy and Permissions w3c/webappsec-permissions-policy#166 (3 comments by @clelland, @martinthomson, @raymeskhoury)
-
Proposal: navigation-override w3c/webappsec-permissions-policy#175 (3 comments by @jihyerish, @Malvoz)
-
Central list of policies w3c/webappsec-permissions-policy#255 (2 comments by @annevk, @craigfrancis)
-
Need to define behaviour of features in associated browsing contexts w3c/webappsec-permissions-policy#173 (1 comment by @clelland)
-
Remove the entire Integrations section (monkey patch) w3c/webappsec-permissions-policy#245 (1 comment by @clelland)
-
Need to define the language used to define the ASCII serialization of policy directives w3c/webappsec-permissions-policy#222 (1 comment by @annevk)
-
-
6 pull requests opened.
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#259, by @clelland.
-
Fix some broken references w3c/webappsec-permissions-policy#258, by @clelland.
-
Remove allowusermedia from spec w3c/webappsec-permissions-policy#257, by @clelland.
-
Fix a typo in features.md w3c/webappsec-permissions-policy#254, by @morten-olsen.
-
Remove integrations section. w3c/webappsec-permissions-policy#246, by @clelland.
-
Updating image policies w3c/webappsec-permissions-policy#240, by @loonybear.
-
-
6 pull requests merged.
-
Remove allowusermedia from spec w3c/webappsec-permissions-policy#257.
-
Fix some broken references w3c/webappsec-permissions-policy#258.
-
Fix a typo in features.md w3c/webappsec-permissions-policy#254.
-
Remove integrations section. w3c/webappsec-permissions-policy#246.
-
Updating image policies w3c/webappsec-permissions-policy#240.
-
Updates to animations.md w3c/webappsec-permissions-policy#239.
-
-
2 pull requests closed.
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#170.
-
Rename and fix type of {line,column}Number w3c/webappsec-permissions-policy#237.
-
-
6 pull requests received 17 new comments.
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220 (3 comments by @eeeps)
-
Fix a typo in features.md w3c/webappsec-permissions-policy#254 (2 comments by @clelland, @morten-olsen)
-
Remove integrations section. w3c/webappsec-permissions-policy#246 (2 comments by @clelland, @sideshowbarker)
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#170 (1 comment by @clelland)
w3c/webappsec-csp
-
6 issues opened.
-
Make CSP inheritance for javascript: more explicit w3c/webappsec-csp#368, by @ckerschb.
-
Broken references in "Integration with Fetch" section w3c/webappsec-csp#367, by @bzbarsky.
-
Bug in directive-value grammar w3c/webappsec-csp#366, by @shekyan.
-
Initialize document CSP in html needs to be updated w3c/webappsec-csp#364, by @andypaicu.
-
CSP 3 draft does not conform to the HTTP/1.1 standard for headers w3c/webappsec-csp#361, by @markushausammann.
-
Using active document of a browsing context introduces a security vulnerability w3c/webappsec-csp#360, by @andypaicu.
-
-
13 issues closed.
-
Handling of 'self' is unclear when inheriting CSP to local scheme w3c/webappsec-csp#248.
-
What is the 'self' of sandboxed page? w3c/webappsec-csp#260.
-
Is inheritance of 'self' to local-scheme appropriate? w3c/webappsec-csp#259.
-
Broken references in "Integration with Fetch" section w3c/webappsec-csp#367.
-
Using active document of a browsing context introduces a security vulnerability w3c/webappsec-csp#360.
-
Add note about the importance of preventing nonce exfiltration/reuse w3c/webappsec-csp#258.
-
Note somewhere that redirects are covered by fetch directives. w3c/webappsec-csp#72.
-
Please sort out who's responsible for a srcdoc document's CSP w3c/webappsec-csp#209.
-
Initialialization of a document's CSP doesn't really make sense in the "local scheme" bit w3c/webappsec-csp#211.
-
WPT tests tracker w3c/webappsec-csp#276.
-
SecurityPolicyViolationEvent needs more USVString w3c/webappsec-csp#266.
-
Line and column number types w3c/webappsec-csp#268.
-
-
12 issues received 37 new comments.
-
Make CSP inheritance for javascript: more explicit w3c/webappsec-csp#368 (10 comments by @andypaicu, @annevk, @bzbarsky, @mikewest)
-
Bug in directive-value grammar w3c/webappsec-csp#366 (9 comments by @andypaicu, @michaelficarra, @mikewest, @shekyan)
-
CSP 3 draft does not conform to the HTTP/1.1 standard for headers w3c/webappsec-csp#361 (6 comments by @arturjanc, @markushausammann, @mikewest)
-
Using active document of a browsing context introduces a security vulnerability w3c/webappsec-csp#360 (3 comments by @andypaicu, @bzbarsky)
-
Initialize document CSP in html needs to be updated w3c/webappsec-csp#364 (2 comments by @andypaicu)
-
Handling of 'self' is unclear when inheriting CSP to local scheme w3c/webappsec-csp#248 (1 comment by @andypaicu)
-
Broken references in "Integration with Fetch" section w3c/webappsec-csp#367 (1 comment by @andypaicu)
-
Handling of javascript: navigations is not interoperable, spec doesn't match most implementations w3c/webappsec-csp#322 (1 comment by @andypaicu)
-
-
7 pull requests opened.
-
Handle a null request in init document csp algorithm w3c/webappsec-csp#372, by @andypaicu.
-
image-src => img-src w3c/webappsec-csp#371, by @gapple.
-
Added javascript: scheme specifically and fixed a small comment w3c/webappsec-csp#370, by @andypaicu.
-
Updated references from main fetch w3c/webappsec-csp#369, by @andypaicu.
-
Use request's client instead of the source browsing context to get a navigation initiator's CSP list w3c/webappsec-csp#365, by @andypaicu.
-
Specify behavior in case of malformed policies w3c/webappsec-csp#363, by @andypaicu.
-
Add a `self-origin` member to policy to facilitate opaque origin contexts that inherit their policies w3c/webappsec-csp#362, by @andypaicu.
-
-
8 pull requests merged.
-
image-src => img-src w3c/webappsec-csp#371.
-
Updated references from main fetch w3c/webappsec-csp#369.
-
Added more notes about nonce attacks w3c/webappsec-csp#356.
-
Inherit source browsing context's CSP instead of parent/opener w3c/webappsec-csp#358.
-
Added a note about fetch redirects being covered w3c/webappsec-csp#359.
-
Changed names of some SPV event members w3c/webappsec-csp#353.
-
1 pull request closed.
-
Clean up CSP list initialization. w3c/webappsec-csp#210.
-
-
7 pull requests received 28 new comments.
-
Specify behavior in case of malformed policies w3c/webappsec-csp#363 (14 comments by @andypaicu, @michaelficarra, @mikewest, @shekyan)
-
Inherit source browsing context's CSP instead of parent/opener w3c/webappsec-csp#358 (6 comments by @andypaicu, @bzbarsky)
-
Handle a null request in init document csp algorithm w3c/webappsec-csp#372 (2 comments by @andypaicu)
-
Add a `self-origin` member to policy to facilitate opaque origin contexts that inherit their policies w3c/webappsec-csp#362 (2 comments by @andypaicu, @mikewest)
-
w3c/trusted-types
-
1 issue opened.
-
Facilitate creating trusted types from string literals w3c/trusted-types#96, by @littledan.
-
-
1 issue received 14 new comments.
-
Facilitate creating trusted types from string literals w3c/trusted-types#96 (14 comments by @koto, @littledan, @ljharb, @mikesamuel, @xtofian)
-
-
2 pull requests opened.
-
Fix bootstrap in the presence of native implementation. w3c/trusted-types#98, by @koto.
-
Fixed the build on Node v11 w3c/trusted-types#97, by @koto.
-
-
2 pull requests merged.
-
Fix bootstrap in the presence of native implementation. w3c/trusted-types#98.
-
Fixed the build on Node v11 w3c/trusted-types#97.
-
w3c/webcrypto
-
2 issues opened.
-
Accept shared ArrayBufferView also? w3c/webcrypto#213, by @jimmywarting.
-
PBKDF2 to ECDSA/EdDSA key w3c/webcrypto#212, by @inkeliz.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Separate headers w3c/webappsec-fetch-metadata#6, by @annevk.
-
-
1 issue received 1 new comment.
w3c/webappsec-subresource-integrity
-
2 issues received 21 new comments.
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20 (17 comments by @annevk, @devd, @ericlaw1979, @mikewest, @rcbarnett-zz, @ScottHelme)
-
What about RDF ? w3c/webappsec-subresource-integrity#76 (4 comments by @awwright, @BigBlueHat, @dveditz, @mozfreddyb)
-
w3c/permissions
-
1 issue opened.
-
Automation: Need two more steps to handle closed browsing context and user prompts w3c/permissions#347, by @Honry.
-
-
1 pull request received 1 new comment.
w3c/webappsec-clear-site-data
-
3 issues opened.
-
[Q] What happens when "executionContexts" is present along with Location header? w3c/webappsec-clear-site-data#56, by @ashucg.
-
Clear-site-data: cookies facilitates malicious cookie flushing by sibling domains w3c/webappsec-clear-site-data#55, by @dveditz.
-
Normative spec doesn't necessarily terminate service workers w3c/webappsec-clear-site-data#54, by @asakusuma.
-
-
3 issues received 5 new comments.
-
Is registerProtocolHandler() affected? w3c/webappsec-clear-site-data#37 (2 comments by @annevk, @dveditz)
-
Define the behavior for third-party cookie blocking. w3c/webappsec-clear-site-data#52 (2 comments by @dveditz, @ericlaw1979)
-
[Q] What happens when "executionContexts" is present along with Location header? w3c/webappsec-clear-site-data#56 (1 comment by @annevk)
-
w3c/webappsec
-
1 issue opened.
-
Distrusting the web server w3c/webappsec#538, by @llebout.
-
w3c/webappsec-change-password-url
-
5 issues opened.
-
Use RFC2119 to put constraints on actors doing $foo, not on things being $bar or having $baz w3c/webappsec-change-password-url#5, by @frivoal.
-
Add informative text clarifying that servers may use complex logic to determine where to redirect to w3c/webappsec-change-password-url#4, by @craigfrancis.
-
Consider adding a bit more detail to the generation algorithm. w3c/webappsec-change-password-url#2, by @mikewest.
-
Figure out how to get this to show up on wicg.github.io w3c/webappsec-change-password-url#1, by @hober.
-
-
1 issue closed.
-
Figure out how to get this to show up on wicg.github.io w3c/webappsec-change-password-url#1.
-
-
2 issues received 4 new comments.
-
Consider adding a bit more detail to the generation algorithm. w3c/webappsec-change-password-url#2 (3 comments by @annevk, @mikewest)
-
Figure out how to get this to show up on wicg.github.io w3c/webappsec-change-password-url#1 (1 comment by @hober)
-
w3c/webappsec-credential-management
-
1 pull request received 3 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (3 comments by @equalsJeffH)
-
TR publications
-
1 document published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
GitHub
w3c/webappsec-permissions-policy
-
12 issues opened.
-
[Proposal] Different script contexts with different feature policy. w3c/webappsec-permissions-policy#238, by @indigotime.
-
feature request: a 'default' directive similar to CSP's 'default-src' w3c/webappsec-permissions-policy#236, by @roycewilliams.
-
TPAC 2018 Breakout Session IRC Notes w3c/webappsec-permissions-policy#235, by @clelland.
-
(Probably?) insecure featurePolicy inherit algorithm w3c/webappsec-permissions-policy#233, by @bakulf.
-
Need to define how 'src' works with sandboxed frames w3c/webappsec-permissions-policy#230, by @clelland.
-
Remove allowusermedia w3c/webappsec-permissions-policy#228, by @jan-ivar.
-
Container policy doesn't seem to make sense w3c/webappsec-permissions-policy#227, by @bzbarsky.
-
Feature policy seems totally broken for fullscreen w3c/webappsec-permissions-policy#226, by @bzbarsky.
-
allowusermediarequest or allowusermedia attribute? w3c/webappsec-permissions-policy#225, by @bakulf.
-
unsigned long? lineNumber and columnNumber in FeaturePolicyViolationReportBody w3c/webappsec-permissions-policy#224, by @bakulf.
-
HTMLIFrameElement and srcdoc w3c/webappsec-permissions-policy#223, by @bakulf.
-
Need to define the language used to define the ASCII serialization of policy directives w3c/webappsec-permissions-policy#222, by @bzbarsky.
-
-
8 issues closed.
-
feature request: a 'default' directive similar to CSP's 'default-src' w3c/webappsec-permissions-policy#236.
-
Container policy doesn't seem to make sense w3c/webappsec-permissions-policy#227.
-
TPAC 2018 Breakout Session IRC Notes w3c/webappsec-permissions-policy#235.
-
Feature policy seems totally broken for fullscreen w3c/webappsec-permissions-policy#226.
-
(Probably?) insecure featurePolicy inherit algorithm w3c/webappsec-permissions-policy#233.
-
HTMLIFrameElement and srcdoc w3c/webappsec-permissions-policy#223.
-
allowusermediarequest or allowusermedia attribute? w3c/webappsec-permissions-policy#225.
-
Feature proposal: sync-xhr w3c/webappsec-permissions-policy#126.
-
-
15 issues received 50 new comments.
-
Container policy doesn't seem to make sense w3c/webappsec-permissions-policy#227 (9 comments by @bzbarsky, @clelland)
-
Need to define how 'src' works with sandboxed frames w3c/webappsec-permissions-policy#230 (8 comments by @annevk, @bakulf, @bzbarsky, @clelland)
-
unsigned long? lineNumber and columnNumber in FeaturePolicyViolationReportBody w3c/webappsec-permissions-policy#224 (6 comments by @andypaicu, @annevk, @clelland, @paulmeyer90)
-
(Probably?) insecure featurePolicy inherit algorithm w3c/webappsec-permissions-policy#233 (6 comments by @bzbarsky, @clelland)
-
Feature policy seems totally broken for fullscreen w3c/webappsec-permissions-policy#226 (6 comments by @bzbarsky, @clelland)
-
[Proposal] Different script contexts with different feature policy. w3c/webappsec-permissions-policy#238 (2 comments by @annevk, @indigotime)
-
feature request: a 'default' directive similar to CSP's 'default-src' w3c/webappsec-permissions-policy#236 (2 comments by @clelland, @roycewilliams)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (2 comments by @AfroThundr3007730, @sstelfox)
-
Proposal: [FeaturePolicy] WebIDL attribute w3c/webappsec-permissions-policy#206 (1 comment by @clelland)
-
Allow document.cookie and maybe Set-Cookie from the server to be controlled w3c/webappsec-permissions-policy#85 (1 comment by @Malvoz)
-
-
6 pull requests opened.
-
Updates to animations.md w3c/webappsec-permissions-policy#239, by @ehsan-karamad.
-
Rename and fix type of {line,column}Number w3c/webappsec-permissions-policy#237, by @clelland.
-
Fix inherited policy calculation w3c/webappsec-permissions-policy#234, by @clelland.
-
Update vertical_scroll.md w3c/webappsec-permissions-policy#232, by @ehsan-karamad.
-
Update the 'declared origin' algorithm. w3c/webappsec-permissions-policy#231, by @clelland.
-
Fix inherited policy origin w3c/webappsec-permissions-policy#229, by @clelland.
-
-
5 pull requests merged.
-
Fix inherited policy calculation w3c/webappsec-permissions-policy#234.
-
Fix inherited policy origin w3c/webappsec-permissions-policy#229.
-
Update the 'declared origin' algorithm. w3c/webappsec-permissions-policy#231.
-
Update vertical_scroll.md w3c/webappsec-permissions-policy#232.
-
[lazyload.md] Correct parametric policy example w3c/webappsec-permissions-policy#210.
-
-
6 pull requests received 17 new comments.
-
Add Feature Policy for workers w3c/webappsec-permissions-policy#174 (4 comments by @annevk, @clelland, @odejesush, @wanderview)
-
Clarify what allowusermedia actually does. w3c/webappsec-permissions-policy#164 (4 comments by @clelland, @jan-ivar)
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220 (4 comments by @jakearchibald)
-
Update the 'declared origin' algorithm. w3c/webappsec-permissions-policy#231 (2 comments by @bzbarsky, @clelland)
-
[lazyload.md] Correct parametric policy example w3c/webappsec-permissions-policy#210 (2 comments by @clelland, @ehsan-karamad)
-
w3c/webappsec-csp
-
3 issues opened.
-
Should CSPEE be its own repository? w3c/webappsec-csp#352, by @annevk.
-
How is CSPEE recursive? w3c/webappsec-csp#351, by @annevk.
-
Allow report-to in CSP and CSPRO meta tags w3c/webappsec-csp#348, by @ScottHelme.
-
-
22 issues closed.
-
Specify browser behavior for CSP headers on 304 (not modified) responses w3c/webappsec-csp#161.
-
Embedded: Think about the implications of allowing injected `csp` with reporting. w3c/webappsec-csp#126.
-
Embedded Enforcement: Invalid required csp attribute on iframe w3c/webappsec-csp#131.
-
Clarify what is the threat model for embedded enforcement w3c/webappsec-csp#44.
-
Embedded: consider other contexts other than iframe w3c/webappsec-csp#49.
-
Embedding-CSP header w3c/webappsec-csp#115.
-
How is CSPEE recursive? w3c/webappsec-csp#351.
-
Should CSPEE be its own repository? w3c/webappsec-csp#352.
-
`navigation request’s URL` is unclear w3c/webappsec-csp#343.
-
Spec nav-items not totally visible due to overflow at some break-points w3c/webappsec-csp#339.
-
Hash encodings should be converted to UTF-8 w3c/webappsec-csp#109.
-
Case-sensitivity resulting in divergent browser behavior w3c/webappsec-csp#236.
-
Wrap up CSP 3, Move to CSP 4 w3c/webappsec-csp#275.
-
bikeshed: LINK ERROR: No 'idl' refs found for 'nonce' with for='NoncedElement' w3c/webappsec-csp#281.
-
Incorrect form-action pre-navigation check text? w3c/webappsec-csp#257.
-
"Whitelisting external JavaScript with hashes" incorrectly assumes encoding of sources w3c/webappsec-csp#110.
-
CSP: clarify whitespace characters w3c/webappsec-csp#5.
-
Grammar: Clarity regarding constraints applied to path-part (path-absolute) production w3c/webappsec-csp#303.
-
Update comment of directive value parsing w3c/webappsec-csp#307.
-
The effective directive for violations is incorrect w3c/webappsec-csp#324.
-
-
1 issue reopened.
-
Hash encodings should be converted to UTF-8 w3c/webappsec-csp#109, by @andypaicu.
-
-
20 issues received 81 new comments.
-
CSP: form-action and redirects w3c/webappsec-csp#8 (32 comments by @andypaicu, @annevk, @Changaco, @iquito, @ptoomey3, @ThrawnCA)
-
CSP violation report should not use redirect-mode: "error" w3c/webappsec-csp#320 (7 comments by @annevk, @mikewest, @yutakahirano)
-
Specify browser behavior for CSP headers on 304 (not modified) responses w3c/webappsec-csp#161 (6 comments by @andypaicu, @annevk, @mnot)
-
Allow CSP-Report-Only in meta tags. w3c/webappsec-csp#277 (5 comments by @annevk, @dveditz, @mikewest)
-
Allow report-to in CSP and CSPRO meta tags w3c/webappsec-csp#348 (2 comments by @dveditz, @ScottHelme)
-
Spec nav-items not totally visible due to overflow at some break-points w3c/webappsec-csp#339 (2 comments by @andypaicu, @Malvoz)
-
"Whitelisting external JavaScript with hashes" incorrectly assumes encoding of sources w3c/webappsec-csp#110 (2 comments by @andypaicu, @annevk)
-
Embedded: Think about the implications of allowing injected `csp` with reporting. w3c/webappsec-csp#126 (1 comment by @mikewest)
-
Embedded Enforcement: Invalid required csp attribute on iframe w3c/webappsec-csp#131 (1 comment by @mikewest)
-
Clarify what is the threat model for embedded enforcement w3c/webappsec-csp#44 (1 comment by @mikewest)
-
Embedded: make clear that servers MUST respond with a CSP or Allow-CSP-From header, <meta> CSP's are not allowed. w3c/webappsec-csp#225 (1 comment by @mikewest)
-
-
11 pull requests opened.
-
Added a note about fetch redirects being covered w3c/webappsec-csp#359, by @andypaicu.
-
Inherit source browsing context's CSP instead of parent/opener w3c/webappsec-csp#358, by @andypaicu.
-
Added note in 'strict-dynamic' section to alert developers around potential avenues of attack w3c/webappsec-csp#357, by @andypaicu.
-
Added more notes about nonce attacks w3c/webappsec-csp#356, by @andypaicu.
-
Fixed various bikeshed linking warnings and removed embedded from mak… w3c/webappsec-csp#355, by @andypaicu.
-
Fixed various bikeshed linking warnings and removed embedded from mak… w3c/webappsec-csp#354, by @andypaicu.
-
Changed names of some SPV event members w3c/webappsec-csp#353, by @andypaicu.
-
Fixed navigations running on URL instead of current URL w3c/webappsec-csp#347, by @andypaicu.
-
Directive names should be lowercased (basically case-insensitive) w3c/webappsec-csp#346, by @andypaicu.
-
Fixed text for form-action prenavigate w3c/webappsec-csp#345, by @andypaicu.
-
Adding note explaining difference between SRI and CSP hashes w3c/webappsec-csp#344, by @andypaicu.
-
-
10 pull requests merged.
-
Fixed various bikeshed linking warnings and removed embedded from mak… w3c/webappsec-csp#355.
-
Fixed navigations running on URL instead of current URL w3c/webappsec-csp#347.
-
Directive names should be lowercased (basically case-insensitive) w3c/webappsec-csp#346.
-
Fixed text for form-action prenavigate w3c/webappsec-csp#345.
-
Adding note explaining difference between SRI and CSP hashes w3c/webappsec-csp#344.
-
Fixing whitespace issues and 2 comments in the area w3c/webappsec-csp#340.
-
Convert string to UTF-8 before applying hash algorithms w3c/webappsec-csp#342.
-
Using the correct directive name when reporting violations w3c/webappsec-csp#337.
-
Admin stuff w3c/webappsec-csp#341.
-
1 pull request closed.
-
Fixed various bikeshed linking warnings and removed embedded from mak… w3c/webappsec-csp#354.
-
-
9 pull requests received 37 new comments.
-
Changed names of some SPV event members w3c/webappsec-csp#353 (11 comments by @andypaicu, @annevk, @mikewest)
-
Directive names should be lowercased (basically case-insensitive) w3c/webappsec-csp#346 (7 comments by @andypaicu, @annevk, @mikewest)
-
Added more notes about nonce attacks w3c/webappsec-csp#356 (6 comments by @andypaicu, @arturjanc, @mikewest)
-
Fixing whitespace issues and 2 comments in the area w3c/webappsec-csp#340 (5 comments by @andypaicu, @mikewest)
-
Inherit source browsing context's CSP instead of parent/opener w3c/webappsec-csp#358 (2 comments by @andypaicu)
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (2 comments by @annevk, @arturjanc)
-
Convert string to UTF-8 before applying hash algorithms w3c/webappsec-csp#342 (2 comments by @andypaicu)
-
Added note in 'strict-dynamic' section to alert developers around potential avenues of attack w3c/webappsec-csp#357 (1 comment by @arturjanc)
-
Fixed various bikeshed linking warnings and removed embedded from mak… w3c/webappsec-csp#354 (1 comment by @andypaicu)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
create-a-cred and request-a-cred ought to return only a cred or error w3c/webappsec-credential-management#129, by @equalsJeffH.
-
-
2 issues received 13 new comments.
-
copy (aka snapshot) any buffersources in options before going async w3c/webappsec-credential-management#128 (12 comments by @annevk, @bzbarsky, @equalsJeffH, @jcjones, @mikewest)
-
create-a-cred and request-a-cred ought to return only a cred or error w3c/webappsec-credential-management#129 (1 comment by @equalsJeffH)
-
-
1 pull request opened.
-
fix issue #128 copy buffer sources w3c/webappsec-credential-management#130, by @equalsJeffH.
-
-
1 pull request merged.
-
Fix typo: unambiguously w3c/webappsec-credential-management#121.
-
-
3 pull requests received 14 new comments.
-
fix issue #128 copy buffer sources w3c/webappsec-credential-management#130 (9 comments by @equalsJeffH, @jcjones, @mikewest)
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (4 comments by @equalsJeffH, @mikewest)
-
w3c/webappsec-clear-site-data
-
3 issues opened.
-
Clear Cache API caches w3c/webappsec-clear-site-data#53, by @inexorabletash.
-
Define the behavior for third-party cookie blocking. w3c/webappsec-clear-site-data#52, by @mikewest.
-
Redesign of "extract header list values" expected w3c/webappsec-clear-site-data#51, by @annevk.
-
-
1 issue closed.
-
Explainer w3c/webappsec-clear-site-data#31.
-
-
6 issues received 9 new comments.
-
Rename "executionContexts" w3c/webappsec-clear-site-data#23 (3 comments by @annevk, @domenic, @mikewest)
-
Define the behavior for third-party cookie blocking. w3c/webappsec-clear-site-data#52 (2 comments by @ericlaw1979, @msramek)
-
Setting and clearing data in same response w3c/webappsec-clear-site-data#33 (1 comment by @slightlyoff)
-
-
1 pull request merged.
-
Update server file to be used with Python 3 w3c/webappsec-clear-site-data#36.
-
w3c/webappsec-cspee
-
8 issues opened.
-
Sites should be able to specify a default required CSP w3c/webappsec-cspee#8, by @michael-oneill.
-
Embedded: Think about the implications of allowing injected `csp` with reporting. w3c/webappsec-cspee#7, by @mikewest.
-
Embedded Enforcement: Invalid required csp attribute on iframe w3c/webappsec-cspee#6, by @mikewest.
-
Clarify what is the threat model for embedded enforcement w3c/webappsec-cspee#5, by @mikewest.
-
Embedded: consider other contexts other than iframe w3c/webappsec-cspee#4, by @mikewest.
-
Embedding-CSP header w3c/webappsec-cspee#3, by @mikewest.
-
How is CSPEE recursive? w3c/webappsec-cspee#1, by @mikewest.
-
-
5 issues received 25 new comments.
-
Sites should be able to specify a default required CSP w3c/webappsec-cspee#8 (3 comments by @dveditz, @michael-oneill)
-
Embedded: make clear that servers MUST respond with a CSP or Allow-CSP-From header, <meta> CSP's are not allowed. w3c/webappsec-cspee#2 (2 comments by @mikewest)
w3c/trusted-types
-
4 issues opened.
-
Create commonly used and harmless constants like TrustedHTML.EMPTY w3c/trusted-types#95, by @koto.
-
Browser extensions vs Trusted Types w3c/trusted-types#94, by @koto.
-
Figure out if TrustedXYZ objects should be Transferable w3c/trusted-types#93, by @koto.
-
Apply restrictions also to Shadow DOM w3c/trusted-types#88, by @koto.
-
-
2 issues closed.
-
Apply restrictions also to Shadow DOM w3c/trusted-types#88.
-
Make sure polyfill does not conflict with the native implementation w3c/trusted-types#80.
-
-
1 issue received 1 new comment.
-
Consider metadata API; building blocks for HTML sanitizers w3c/trusted-types#43 (1 comment by @koto)
-
-
8 pull requests opened.
-
Completing a fallback policy support (with a name 'default') w3c/trusted-types#92, by @koto.
-
Updated the dist/ files. w3c/trusted-types#91, by @koto.
-
Require TrustedHTML for ShadowRoot.innerHTML. w3c/trusted-types#90, by @koto.
-
setAttrbute('on*', null) is allowed when TT are enforced. w3c/trusted-types#89, by @koto.
-
Adjustments to align with native Chrome implementation. w3c/trusted-types#87, by @koto.
-
Revamped the WPT test runner script. w3c/trusted-types#86, by @koto.
-
Added TrustedScript requirement for setInterval/Timeout. w3c/trusted-types#85, by @koto.
-
Enforcer is not enabled if native TT implementation is present. w3c/trusted-types#84, by @koto.
-
-
8 pull requests merged.
-
Completing a fallback policy support (with a name 'default') w3c/trusted-types#92.
-
Updated the dist/ files. w3c/trusted-types#91.
-
Require TrustedHTML for ShadowRoot.innerHTML. w3c/trusted-types#90.
-
setAttrbute('on*', null) is allowed when TT are enforced. w3c/trusted-types#89.
-
Adjustments to align with native Chrome implementation. w3c/trusted-types#87.
-
Revamped the WPT test runner script. w3c/trusted-types#86.
-
Added TrustedScript requirement for setInterval/Timeout. w3c/trusted-types#85.
-
Enforcer is not enabled if native TT implementation is present. w3c/trusted-types#84.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
TAG Requesting Status w3c/webappsec-secure-contexts#62, by @torgo.
-
-
1 issue reopened.
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28, by @annevk.
-
-
1 issue received 1 new comment.
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28 (1 comment by @bzbarsky)
-
w3c/webappsec
-
1 issue opened.
-
Report Iframe nesting level instead of using frame-ancestors directive w3c/webappsec#537, by @indigotime.
-
-
1 issue closed.
-
[SRI] Shared Cache through `sharedcache` attribute w3c/webappsec#504.
-
-
2 issues received 2 new comments.
-
Report Iframe nesting level instead of using frame-ancestors directive w3c/webappsec#537 (1 comment by @annevk)
-
w3c/webappsec-referrer-policy
-
2 issues opened.
-
How referrer policy deal with iframe srcdoc ? w3c/webappsec-referrer-policy#116, by @lnyzx.
-
Redesign of "extract header list values" expected w3c/webappsec-referrer-policy#115, by @annevk.
-
-
4 issues closed.
-
noreferrer isn't integrated with <link> w3c/webappsec-referrer-policy#74.
-
"TLS-protected" link seems not very useful w3c/webappsec-referrer-policy#82.
-
add back "none" as legacy keyword w3c/webappsec-referrer-policy#112.
-
How referrer policy deal with iframe srcdoc ? w3c/webappsec-referrer-policy#116.
-
-
1 issue reopened.
-
noreferrer isn't integrated with <link> w3c/webappsec-referrer-policy#74, by @jeisinger.
-
-
7 issues received 13 new comments.
-
noreferrer isn't integrated with <link> w3c/webappsec-referrer-policy#74 (4 comments by @domenic, @jeisinger, @mikewest)
-
Should JavaScript module imports respect referrer policy, and if so, how? w3c/webappsec-referrer-policy#111 (3 comments by @domenic, @domfarolino, @mikewest)
-
Referrer policy of referencing in SVG? w3c/webappsec-referrer-policy#108 (2 comments by @jeisinger, @mikewest)
-
Redesign of "extract header list values" expected w3c/webappsec-referrer-policy#115 (1 comment by @mikewest)
-
"TLS-protected" link seems not very useful w3c/webappsec-referrer-policy#82 (1 comment by @mikewest)
-
How referrer policy deal with iframe srcdoc ? w3c/webappsec-referrer-policy#116 (1 comment by @mikewest)
-
-
1 pull request opened.
-
rel="noreferrer" is not supported for <link> elements w3c/webappsec-referrer-policy#117, by @jeisinger.
-
-
1 pull request merged.
-
rel="noreferrer" is not supported for <link> elements w3c/webappsec-referrer-policy#117.
-
w3c/webappsec-fetch-metadata
-
2 issues opened.
-
Expose the request's `mode' value w3c/webappsec-fetch-metadata#5, by @arturjanc.
-
Is this spec been testing in Google Chrome already? w3c/webappsec-fetch-metadata#4, by @liuyanghejerry.
-
-
1 issue closed.
-
Is this spec been testing in Google Chrome already? w3c/webappsec-fetch-metadata#4.
-
-
3 issues received 4 new comments.
-
Expose the request's `mode' value w3c/webappsec-fetch-metadata#5 (2 comments by @arturjanc, @mikewest)
-
Is this spec been testing in Google Chrome already? w3c/webappsec-fetch-metadata#4 (1 comment by @mikewest)
-
w3c/webcrypto
-
2 issues received 2 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @dvoytenko)
-
-
1 pull request opened.
-
Fix case typo of "I" in "UInt8ClampedArray" w3c/webcrypto#211, by @hatgit.
-
w3c/permissions
-
1 issue opened.
-
Allow Permissions Policy-based permission models w3c/permissions#185, by @jan-ivar.
-
-
1 issue closed.
-
A new permission for screen-sharing with getDisplayMedia() w3c/permissions#182.
-
-
1 issue received 2 new comments.
-
Allow Permissions Policy-based permission models w3c/permissions#185 (2 comments by @jan-ivar, @raymeskhoury)
-
-
1 pull request opened.
-
Add 'display' permission for screen-capture. w3c/permissions#184, by @jan-ivar.
-
-
1 pull request merged.
-
Add 'display' permission for screen-capture. w3c/permissions#184.
-
-
2 pull requests received 15 new comments.
-
Add 'display' permission for screen-capture. w3c/permissions#184 (12 comments by @jan-ivar, @marcoscaceres, @mounirlamouri)
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163 (3 comments by @jan-ivar, @marcoscaceres)
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
w3c/webappsec-mixed-content
-
1 pull request merged.
-
Admin stuff w3c/webappsec-mixed-content#16.
-
GitHub
w3c/webappsec-permissions-policy
-
8 issues opened.
-
Proposal: Ping-policy w3c/webappsec-permissions-policy#221, by @Malvoz.
-
Consider moving to Web App Sec? w3c/webappsec-permissions-policy#218, by @marcoscaceres.
-
Rename document.policy to document.featurePolicy w3c/webappsec-permissions-policy#216, by @johannhof.
-
Clarify how features are disabled or enabled w3c/webappsec-permissions-policy#215, by @johannhof.
-
Downloads Feature Policy w3c/webappsec-permissions-policy#213, by @jkarlin.
-
How do I disable everything? w3c/webappsec-permissions-policy#208, by @billinghamj.
-
Feature-Policy and Workers w3c/webappsec-permissions-policy#207, by @bakulf.
-
Proposal: [FeaturePolicy] WebIDL attribute w3c/webappsec-permissions-policy#206, by @bakulf.
-
-
1 issue closed.
-
aware/oblivious w3c/webappsec-permissions-policy#114.
-
-
8 issues received 36 new comments.
-
Downloads Feature Policy w3c/webappsec-permissions-policy#213 (12 comments by @annevk, @clelland, @jkarlin)
-
Consider moving to Web App Sec? w3c/webappsec-permissions-policy#218 (6 comments by @clelland, @marcoscaceres, @mikewest, @wseltzer)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (5 comments by @eeeps, @igrigorik, @mikewest)
-
How do I disable everything? w3c/webappsec-permissions-policy#208 (5 comments by @billinghamj, @clelland, @Malvoz)
-
Rename document.policy to document.featurePolicy w3c/webappsec-permissions-policy#216 (3 comments by @ckerschb, @clelland, @johannhof)
-
Clarify how features are disabled or enabled w3c/webappsec-permissions-policy#215 (3 comments by @clelland, @johannhof)
-
-
6 pull requests opened.
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220, by @eeeps.
-
Merge parsers w3c/webappsec-permissions-policy#219, by @clelland.
-
Remove report message w3c/webappsec-permissions-policy#217, by @clelland.
-
Update animations.md w3c/webappsec-permissions-policy#212, by @ehsan-karamad.
-
[lazyload.md] Correct parametric policy example w3c/webappsec-permissions-policy#210, by @Malvoz.
-
Update explainer for unsized media w3c/webappsec-permissions-policy#209, by @loonybear.
-
-
4 pull requests merged.
-
Update animations.md w3c/webappsec-permissions-policy#212.
-
Merge parsers w3c/webappsec-permissions-policy#219.
-
Remove report message w3c/webappsec-permissions-policy#217.
-
[lazyload.md] Update to fix typos w3c/webappsec-permissions-policy#205.
-
-
5 pull requests received 14 new comments.
-
Update explainer for unsized media w3c/webappsec-permissions-policy#209 (4 comments by @clelland, @loonybear, @yoavweiss)
-
“Should request be allowed to use feature” algorithm w3c/webappsec-permissions-policy#220 (2 comments by @igrigorik)
w3c/webappsec-credential-management
-
1 issue opened.
-
copy (aka snapshot) any buffersources in options before going async w3c/webappsec-credential-management#128, by @equalsJeffH.
-
w3c/webappsec-fetch-metadata
-
1 issue received 1 new comment.
w3c/webappsec-csp
-
5 issues opened.
-
`navigation request’s URL` is unclear w3c/webappsec-csp#343, by @mfalken.
-
Spec nav-items not totally visible due to overflow at some break-points w3c/webappsec-csp#339, by @Malvoz.
-
Should Workers inherit CSP directives from the parent context? w3c/webappsec-csp#336, by @bakulf.
-
Remove mentions of the ws\wss schemes in CSP w3c/webappsec-csp#332, by @andypaicu.
-
Security issue: fragments (after the '#') must not be reported. w3c/webappsec-csp#326, by @alunmj.
-
-
7 issues closed.
-
Directive to disallow external entities in SVG/XML? w3c/webappsec-csp#300.
-
Add [Exposed] to all interfaces w3c/webappsec-csp#237.
-
Documents are not global objects w3c/webappsec-csp#208.
-
script-src chapter should mention worker-src w3c/webappsec-csp#234.
-
Wrong url on example 6 w3c/webappsec-csp#286.
-
Remove worker references from child-src section w3c/webappsec-csp#239.
-
Directives fallback is not property setup for inline checks w3c/webappsec-csp#310.
-
-
9 issues received 19 new comments.
-
Should Workers inherit CSP directives from the parent context? w3c/webappsec-csp#336 (7 comments by @annevk, @bakulf, @mikewest, @wanderview)
-
Remove mentions of the ws\wss schemes in CSP w3c/webappsec-csp#332 (3 comments by @andypaicu, @annevk, @mikewest)
-
Security issue: fragments (after the '#') must not be reported. w3c/webappsec-csp#326 (3 comments by @alunmj, @dveditz)
-
Directives fallback is not property setup for inline checks w3c/webappsec-csp#310 (1 comment by @andypaicu)
-
-
13 pull requests opened.
-
Convert string to UTF-8 before applying hash algorithms w3c/webappsec-csp#342, by @andypaicu.
-
Admin stuff w3c/webappsec-csp#341, by @plehegar.
-
Fixing whitespace issues and 2 comments in the area w3c/webappsec-csp#340, by @andypaicu.
-
Added [Exposed] to the SecurityPolicyViolationEvent interface w3c/webappsec-csp#338, by @andypaicu.
-
Using the correct directive name when reporting violations w3c/webappsec-csp#337, by @andypaicu.
-
Specified worker-src in script-src description w3c/webappsec-csp#335, by @andypaicu.
-
Remove the ISSUE that states that CSP lists are missing from workers w3c/webappsec-csp#334, by @andypaicu.
-
Cleanup of global object/document usage w3c/webappsec-csp#333, by @andypaicu.
-
Added more restrictive conditions to ensure no dodgy schemes are allo… w3c/webappsec-csp#331, by @andypaicu.
-
websocket example url w3c/webappsec-csp#330, by @andypaicu.
-
Various bikeshed warnings and errors w3c/webappsec-csp#329, by @andypaicu.
-
Added {script/style}-src-{attr/elem} to the iana registry section. w3c/webappsec-csp#328, by @andypaicu.
-
Removed disown-opener as it will not make it into CSP3 w3c/webappsec-csp#327, by @andypaicu.
-
-
8 pull requests merged.
-
Added [Exposed] to the SecurityPolicyViolationEvent interface w3c/webappsec-csp#338.
-
Various bikeshed warnings and errors w3c/webappsec-csp#329.
-
Cleanup of global object/document usage w3c/webappsec-csp#333.
-
Specified worker-src in script-src description w3c/webappsec-csp#335.
-
Added more restrictive conditions to ensure no dodgy schemes are allo… w3c/webappsec-csp#331.
-
websocket example url w3c/webappsec-csp#330.
-
Added {script/style}-src-{attr/elem} to the iana registry section. w3c/webappsec-csp#328.
-
Removed disown-opener as it will not make it into CSP3 w3c/webappsec-csp#327.
-
-
2 pull requests closed.
-
Remove the ISSUE that states that CSP lists are missing from workers w3c/webappsec-csp#334.
-
Fix for bikeshed linking error w3c/webappsec-csp#285.
-
-
5 pull requests received 14 new comments.
-
Convert string to UTF-8 before applying hash algorithms w3c/webappsec-csp#342 (4 comments by @annevk)
-
Added more restrictive conditions to ensure no dodgy schemes are allo… w3c/webappsec-csp#331 (4 comments by @andypaicu, @shekyan)
-
Remove the ISSUE that states that CSP lists are missing from workers w3c/webappsec-csp#334 (3 comments by @andypaicu, @annevk)
-
w3c/webappsec-mixed-content
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Admin stuff w3c/webappsec-mixed-content#16, by @plehegar.
-
w3c/webappsec
-
2 issues received 3 new comments.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (1 comment by @andypaicu)
w3c/trusted-types
-
1 issue opened.
-
Make sure polyfill does not conflict with the native implementation w3c/trusted-types#80, by @koto.
-
-
2 issues closed.
-
bool exposed - argument to createPolicy or member of TrustedTypesInnerPolicy? w3c/trusted-types#79.
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11.
-
-
2 issues received 3 new comments.
-
bool exposed - argument to createPolicy or member of TrustedTypesInnerPolicy? w3c/trusted-types#79 (2 comments by @koto)
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11 (1 comment by @koto)
-
-
3 pull requests opened.
-
typo w3c/trusted-types#83, by @mikesamuel.
-
Updated the web platform test runner patch. w3c/trusted-types#82, by @koto.
-
Small changes to align the polyfill with the Chromium implementation: w3c/trusted-types#81, by @koto.
-
-
3 pull requests merged.
-
typo w3c/trusted-types#83.
-
Updated the web platform test runner patch. w3c/trusted-types#82.
-
Small changes to align the polyfill with the Chromium implementation: w3c/trusted-types#81.
-
w3c/permissions
-
1 pull request opened.
-
Adding background fetch w3c/permissions#183, by @jakearchibald.
-
-
2 pull requests merged.
-
Adding background fetch w3c/permissions#183.
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163.
-
-
1 pull request received 2 new comments.
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163 (2 comments by @raymeskhoury)
-
Participants
-
1 participant joined.
-
Jeff Hodges (Google LLC) joined.
-
-
1 participant left.
-
Liam Quin (W3C) left.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Clipboard Access w3c/webappsec-permissions-policy#198, by @lgarron.
-
-
4 issues received 21 new comments.
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (10 comments by @annevk, @clelland, @eeeps, @yoavweiss)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (9 comments by @clelland, @laukstein, @ojanvafai, @olmari, @valtlai)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (1 comment by @eeeps)
-
-
4 pull requests opened.
-
[lazyload.md] Update to fix typos w3c/webappsec-permissions-policy#205, by @Malvoz.
-
Reporting: fix typos w3c/webappsec-permissions-policy#201, by @ebidel.
-
Update README.md - Remove 'vibrate', add link to features.md w3c/webappsec-permissions-policy#199, by @Malvoz.
-
Explainer for 'lazyload' policy w3c/webappsec-permissions-policy#196, by @ehsan-karamad.
-
-
3 pull requests merged.
-
Explainer for 'lazyload' policy w3c/webappsec-permissions-policy#196.
-
Reporting: fix typos w3c/webappsec-permissions-policy#201.
-
Update README.md - Remove 'vibrate', add link to features.md w3c/webappsec-permissions-policy#199.
-
-
3 pull requests received 7 new comments.
-
Explainer for 'lazyload' policy w3c/webappsec-permissions-policy#196 (2 comments by @benschwarz, @ehsan-karamad)
-
Update README.md - Remove 'vibrate', add link to features.md w3c/webappsec-permissions-policy#199 (2 comments by @clelland, @Malvoz)
w3c/trusted-types
-
2 issues opened.
-
bool exposed - argument to createPolicy or member of TrustedTypesInnerPolicy? w3c/trusted-types#79, by @orsi-batiz.
-
Clarify in spec - JS 'this' in policy.createXXX() w3c/trusted-types#78, by @saganatt.
-
-
3 issues received 8 new comments.
-
bool exposed - argument to createPolicy or member of TrustedTypesInnerPolicy? w3c/trusted-types#79 (2 comments by @koto, @mikewest)
-
Clarify in spec - JS 'this' in policy.createXXX() w3c/trusted-types#78 (2 comments by @koto, @mikesamuel)
-
1 pull request opened.
-
typo s/alredy/already/ w3c/trusted-types#77, by @mikesamuel.
-
-
1 pull request merged.
-
typo s/alredy/already/ w3c/trusted-types#77.
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Move "Mixed Content" to PR. w3c/webappsec-mixed-content#15, by @mikewest.
-
w3c/permissions
-
1 issue opened.
-
A new permission for screen-sharing with getDisplayMedia() w3c/permissions#182, by @jan-ivar.
-
-
1 pull request received 1 new comment.
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163 (1 comment by @jan-ivar)
-
w3c/webcrypto
-
1 issue opened.
-
HMAC get key length operation returns default length in bytes, not bits w3c/webcrypto#210, by @harrishancock.
-
-
1 issue closed.
-
2 issues received 5 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @kaizhu256, @neckaros)
w3c/webappsec-csp
-
2 issues opened.
-
The effective directive for violations is incorrect w3c/webappsec-csp#324, by @andypaicu.
-
Feature Request: Support for cross-domain downloads w3c/webappsec-csp#323, by @aarongustafson.
-
-
1 issue closed.
-
Thoughts on letting CSP govern attributes that must appear in Set-Cookie w3c/webappsec-csp#152.
-
-
1 issue reopened.
-
Feature Request: Support for cross-domain downloads w3c/webappsec-csp#323, by @aarongustafson.
-
-
4 issues received 14 new comments.
-
Feature Request: Support for cross-domain downloads w3c/webappsec-csp#323 (10 comments by @aarongustafson, @annevk)
-
Thoughts on letting CSP govern attributes that must appear in Set-Cookie w3c/webappsec-csp#152 (2 comments by @dveditz, @Malvoz)
-
-
1 pull request opened.
-
Added new directives for more granular script and style policies w3c/webappsec-csp#325, by @andypaicu.
-
-
2 pull requests merged.
-
Added new directives for more granular script and style policies w3c/webappsec-csp#325.
-
Refactored fetch directives for readability and logic. w3c/webappsec-csp#318.
-
-
1 pull request closed.
-
Added new directives for more granular script and style policies w3c/webappsec-csp#319.
-
-
3 pull requests received 21 new comments.
-
Added new directives for more granular script and style policies w3c/webappsec-csp#325 (19 comments by @andypaicu, @mikewest)
-
Added new directives for more granular script and style policies w3c/webappsec-csp#319 (1 comment by @andypaicu)
-
Refactored fetch directives for readability and logic. w3c/webappsec-csp#318 (1 comment by @mikewest)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Steps in 2.5.1. should not be run in parallel w3c/webappsec-credential-management#127, by @madblobfish.
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
Participants
-
1 organization left.
-
Yandex left.
-
GitHub
w3c/webcrypto
-
2 issues opened.
-
Add note on IV re-use in AES-GCM w3c/webcrypto#209, by @franziskuskiefer.
-
FrozenArray for CryptoKey.usages? w3c/webcrypto#208, by @saschanaz.
-
-
1 issue closed.
-
Make CryptoKey interface more specific w3c/webcrypto#185.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Use modern IDL block style w3c/webcrypto#207, by @saschanaz.
-
-
1 pull request closed.
-
Use modern IDL block style w3c/webcrypto#207.
-
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
3 issues opened.
-
Feature policy + sandbox review notes w3c/webappsec-permissions-policy#194, by @domenic.
-
"companion document" link 404s w3c/webappsec-permissions-policy#190, by @equalsJeffH.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189, by @laukstein.
-
-
2 issues closed.
-
"companion document" link 404s w3c/webappsec-permissions-policy#190.
-
Spec needs privacy and security section w3c/webappsec-permissions-policy#61.
-
-
7 issues received 15 new comments.
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (4 comments by @clelland, @eeeps, @yoavweiss)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (3 comments by @eeeps, @nico3333fr, @quisido)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (2 comments by @eeeps, @igrigorik)
-
-
6 pull requests opened.
-
Add privacy and security concerns with introspection api w3c/webappsec-permissions-policy#192, by @clelland.
-
Remove vibrate feature w3c/webappsec-permissions-policy#191, by @jpchase.
-
Add Reporting section w3c/webappsec-permissions-policy#188, by @paulmeyer90.
-
Update broken WebVR spec links w3c/webappsec-permissions-policy#187, by @Malvoz.
-
Correct links to policies w3c/webappsec-permissions-policy#186, by @Malvoz.
-
Add privacy and security section w3c/webappsec-permissions-policy#185, by @clelland.
-
-
7 pull requests merged.
-
Add Reporting section w3c/webappsec-permissions-policy#188.
-
Remove vibrate feature w3c/webappsec-permissions-policy#191.
-
Add privacy and security concerns with introspection api w3c/webappsec-permissions-policy#192.
-
Add JavaScript introspection API w3c/webappsec-permissions-policy#184.
-
Update broken WebVR spec links w3c/webappsec-permissions-policy#187.
-
Correct links to policies w3c/webappsec-permissions-policy#186.
-
Add privacy and security section w3c/webappsec-permissions-policy#185.
-
-
5 pull requests received 18 new comments.
-
Add JavaScript introspection API w3c/webappsec-permissions-policy#184 (3 comments by @bzbarsky, @clelland)
-
Add privacy and security section w3c/webappsec-permissions-policy#185 (2 comments by @clelland, @loonybear)
w3c/webappsec-csp
-
4 issues opened.
-
Handling of javascript: navigations is not interoperable, spec doesn't match most implementations w3c/webappsec-csp#322, by @bzbarsky.
-
CSP 4 Feature Request: add new 'default' keyword to compose default-src sources into other directives w3c/webappsec-csp#321, by @Jach.
-
CSP violation report should not use redirect-mode: "error" w3c/webappsec-csp#320, by @yutakahirano.
-
CSP policy is visible in response header w3c/webappsec-csp#317, by @ashok003.
-
-
1 issue closed.
-
CSP policy is visible in response header w3c/webappsec-csp#317.
-
-
7 issues received 19 new comments.
-
Multiple CSP headers restriction is unclear w3c/webappsec-csp#215 (8 comments by @cnsgithub, @nevercast, @shekyan)
-
CSP policy is visible in response header w3c/webappsec-csp#317 (3 comments by @craigfrancis, @dveditz, @ScottHelme)
-
Handling of javascript: navigations is not interoperable, spec doesn't match most implementations w3c/webappsec-csp#322 (2 comments by @bzbarsky)
-
Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. w3c/webappsec-csp#255 (2 comments by @andypaicu, @koto)
-
The `disown-opener` directive is not the right model w3c/webappsec-csp#194 (1 comment by @laukstein)
-
'strict-dynamic' should not be bound to only nonces/hashes w3c/webappsec-csp#309 (1 comment by @arturjanc)
-
-
2 pull requests opened.
-
Added new directives for more granular script and style policies w3c/webappsec-csp#319, by @andypaicu.
-
Refactored fetch directives for readability and logic. w3c/webappsec-csp#318, by @andypaicu.
-
-
1 pull request merged.
-
Un-deprecated child-src w3c/webappsec-csp#313.
-
-
1 pull request received 1 new comment.
-
Added new directives for more granular script and style policies w3c/webappsec-csp#319 (1 comment by @andypaicu)
-
w3c/webappsec-fetch-metadata
-
1 issue received 5 new comments.
-
Name suggestions w3c/webappsec-fetch-metadata#2 (5 comments by @arturjanc, @Jxck, @Malvoz, @mikewest)
-
-
1 pull request opened.
-
Update README "From-Origin" to "Cross-Origin-Resource-Policy" w3c/webappsec-fetch-metadata#3, by @Malvoz.
-
-
1 pull request merged.
-
Update README "From-Origin" to "Cross-Origin-Resource-Policy" w3c/webappsec-fetch-metadata#3.
-
-
1 pull request received 1 new comment.
-
Update README "From-Origin" to "Cross-Origin-Resource-Policy" w3c/webappsec-fetch-metadata#3 (1 comment by @mikewest)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
input type file as iconURL w3c/webappsec-credential-management#126, by @marcoscaceres.
-
CredentialBodyType defined by never used w3c/webappsec-credential-management#122, by @marcoscaceres.
-
-
1 issue closed.
-
CredentialBodyType defined by never used w3c/webappsec-credential-management#122.
-
-
5 pull requests opened.
-
fix: getQuerySelector/querySelector in examples w3c/webappsec-credential-management#125, by @marcoscaceres.
-
fix: navigatior/navigator in examples w3c/webappsec-credential-management#124, by @marcoscaceres.
-
Remove typedef CredentialBodyType w3c/webappsec-credential-management#123, by @marcoscaceres.
-
Fix typo: unambiguously w3c/webappsec-credential-management#121, by @marcoscaceres.
-
Update README.md w3c/webappsec-credential-management#120, by @embds.
-
-
3 pull requests merged.
-
Remove typedef CredentialBodyType w3c/webappsec-credential-management#123.
-
fix: navigatior/navigator in examples w3c/webappsec-credential-management#124.
-
fix: getQuerySelector/querySelector in examples w3c/webappsec-credential-management#125.
-
-
3 pull requests received 3 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (1 comment by @equalsJeffH)
-
Remove typedef CredentialBodyType w3c/webappsec-credential-management#123 (1 comment by @marcoscaceres)
-
w3c/permissions
-
2 issues opened.
-
Automation: "set permission" granularity w3c/permissions#348, by @youennf.
-
Automation: "Get Permission" w3c/permissions#349, by @jugglinmike.
-
-
2 issues received 24 new comments.
-
Automation: "set permission" granularity w3c/permissions#348 (13 comments by @andreastt, @foolip, @jan-ivar, @jugglinmike, @youennf)
-
Automation: "Get Permission" w3c/permissions#349 (11 comments by @alvestrand, @foolip, @jan-ivar, @jugglinmike, @kereliuk, @youennf)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Is it possible to do SRI on importScripts in JS? w3c/webappsec-subresource-integrity#79, by @ghost.
-
-
1 issue received 2 new comments.
-
Is it possible to do SRI on importScripts in JS? w3c/webappsec-subresource-integrity#79 (2 comments by @domenic, @mikewest)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Referrer-Policy header: "strict-same-origin" value w3c/webappsec-referrer-policy#114, by @baptx.
-
-
1 issue closed.
-
Referrer-Policy header: "strict-same-origin" value w3c/webappsec-referrer-policy#114.
-
-
1 issue received 2 new comments.
-
Referrer-Policy header: "strict-same-origin" value w3c/webappsec-referrer-policy#114 (2 comments by @baptx, @dveditz)
-
w3c/trusted-types
-
1 issue closed.
-
Consider surfacing sanitization fallbacks to the developer w3c/trusted-types#21.
-
-
1 issue received 3 new comments.
-
Consider surfacing sanitization fallbacks to the developer w3c/trusted-types#21 (3 comments by @koto)
-
-
5 pull requests opened.
-
Fixing the demo page. w3c/trusted-types#76, by @koto.
-
Release 1.0.4 w3c/trusted-types#75, by @koto.
-
Added linter rules for the test files. w3c/trusted-types#74, by @koto.
-
TrustedTypes.createPolicy accepts a policy object instead of a policy builder w3c/trusted-types#73, by @koto.
-
Small API changes w3c/trusted-types#72, by @koto.
-
-
5 pull requests merged.
-
Fixing the demo page. w3c/trusted-types#76.
-
Release 1.0.4 w3c/trusted-types#75.
-
Added linter rules for the test files. w3c/trusted-types#74.
-
TrustedTypes.createPolicy accepts a policy object instead of a policy builder w3c/trusted-types#73.
-
Small API changes w3c/trusted-types#72.
-
-
1 pull request received 1 new comment.
-
TrustedTypes.createPolicy accepts a policy object instead of a policy builder w3c/trusted-types#73 (1 comment by @koto)
-
w3c/webappsec-secure-contexts
-
1 issue received 5 new comments.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (5 comments by @curry684, @mikewest, @pinobatch)
-
Participants
-
1 organization left.
-
Dropbox, Inc. left.
-
GitHub
w3c/webappsec-permissions-policy
-
4 issues opened.
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183, by @RaederDev.
-
Initializing/inheriting feature policy for unattached (?) documents w3c/webappsec-permissions-policy#176, by @ehsan-karamad.
-
Proposal: navigation-override w3c/webappsec-permissions-policy#175, by @Malvoz.
-
Need to define behaviour of features in associated browsing contexts w3c/webappsec-permissions-policy#173, by @clelland.
-
-
1 issue closed.
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183.
-
-
5 issues received 12 new comments.
-
Need to define behaviour of features in associated browsing contexts w3c/webappsec-permissions-policy#173 (6 comments by @annevk, @clelland)
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183 (2 comments by @clelland, @RaederDev)
-
Initializing/inheriting feature policy for unattached (?) documents w3c/webappsec-permissions-policy#176 (2 comments by @annevk, @ehsan-karamad)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (1 comment by @yoavweiss)
-
-
8 pull requests opened.
-
Add JavaScript introspection API w3c/webappsec-permissions-policy#184, by @clelland.
-
Export `Feature-Policy` as an HTTP header w3c/webappsec-permissions-policy#181, by @foolip.
-
Link {{Document}} in a few places w3c/webappsec-permissions-policy#180, by @foolip.
-
Export "feature policy" and "container policy" definitions w3c/webappsec-permissions-policy#179, by @foolip.
-
Update web-platform-tests URLs w3c/webappsec-permissions-policy#178, by @foolip.
-
fix a typo in the allowusermedia session w3c/webappsec-permissions-policy#177, by @siusin.
-
Add Feature Policy for workers w3c/webappsec-permissions-policy#174, by @odejesush.
-
Introduce Feature policy : `document-write` w3c/webappsec-permissions-policy#172, by @ehsan-karamad.
-
-
2 pull requests merged.
-
Export "feature policy" and "container policy" definitions w3c/webappsec-permissions-policy#179.
-
Update web-platform-tests URLs w3c/webappsec-permissions-policy#178.
-
-
4 pull requests closed.
-
Introduce Feature policy : `document-write` w3c/webappsec-permissions-policy#172.
-
Link {{Document}} in a few places w3c/webappsec-permissions-policy#180.
-
Export `Feature-Policy` as an HTTP header w3c/webappsec-permissions-policy#181.
-
fix a typo in the allowusermedia session w3c/webappsec-permissions-policy#177.
-
-
6 pull requests received 29 new comments.
-
Introduce Feature policy : `document-write` w3c/webappsec-permissions-policy#172 (16 comments by @annevk, @clelland, @ehsan-karamad, @ojanvafai)
-
Add JavaScript introspection API w3c/webappsec-permissions-policy#184 (4 comments by @clelland, @domenic)
-
Add Feature Policy for workers w3c/webappsec-permissions-policy#174 (4 comments by @odejesush, @yoavweiss)
-
Export `Feature-Policy` as an HTTP header w3c/webappsec-permissions-policy#181 (3 comments by @clelland)
-
w3c/trusted-types
-
8 issues opened.
-
Per-type enforcement w3c/trusted-types#66, by @koto.
-
Consider dropping TrustedURL w3c/trusted-types#65, by @koto.
-
Bypass via HTMLAnchorElement properties w3c/trusted-types#64, by @koto.
-
Fallback policy support w3c/trusted-types#63, by @koto.
-
Implement TrustedJavascript w3c/trusted-types#56, by @koto.
-
Figure out what to do with cross-document interactions w3c/trusted-types#50, by @koto.
-
Consider implicit node / subtree adoption w3c/trusted-types#49, by @mikesamuel.
-
Put safeguards around attribute nodes w3c/trusted-types#47, by @mikesamuel.
-
-
10 issues closed.
-
Consider dropping TrustedURL w3c/trusted-types#65.
-
Implement TrustedJavascript w3c/trusted-types#56.
-
Bypasses via attributes w3c/trusted-types#28.
-
"Trusted types" and "Literals in script" w3c/trusted-types#30.
-
Is it possible to lock things down to string constants? w3c/trusted-types#4.
-
Integration idea - use Symbol.hasInstance w3c/trusted-types#22.
-
Mechanism to constrain usages of unsafelyCreate w3c/trusted-types#31.
-
Support application-specific sanitizers / type builders w3c/trusted-types#32.
-
Explore granular enforcement of types w3c/trusted-types#33.
-
TrustedHTML.unwrap vs TrustedHTML.prototype.toString w3c/trusted-types#35.
-
-
17 issues received 37 new comments.
-
Expose information on status of TrustedTypes enforcement w3c/trusted-types#36 (11 comments by @koto, @xtofian)
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11 (1 comment by @koto)
-
-
20 pull requests opened.
-
Violations will dispatch a SecurityPolicyViolationEvent w3c/trusted-types#71, by @koto.
-
Small defensive patches. w3c/trusted-types#70, by @koto.
-
Introduced a 'url-allow-http' keyword to the CSP configuration. w3c/trusted-types#69, by @koto.
-
TrustedTypesEnforcer.install() hijacks setters only if logging or enforcement are enabled w3c/trusted-types#68, by @koto.
-
Made the compilation more strict. w3c/trusted-types#67, by @koto.
-
Changing the license to W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE. w3c/trusted-types#62, by @koto.
-
Allowed functions and null to be assigned to inline event handler attributes w3c/trusted-types#61, by @koto.
-
Added externs file. w3c/trusted-types#60, by @koto.
-
Added enforcement for JS types. w3c/trusted-types#59, by @koto.
-
Added TrustedScript type, w3c/trusted-types#58, by @koto.
-
Do not make the parsed CSP directives & source expressions lowercase. w3c/trusted-types#57, by @koto.
-
Added enforcement for additional sinks. w3c/trusted-types#55, by @koto.
-
TrustedTypes.createPolicy creates a policy that rejects by default. w3c/trusted-types#54, by @koto.
-
Created a CommonJS build target for node. w3c/trusted-types#53, by @koto.
-
Added support for whitelisting policy names via CSP. w3c/trusted-types#52, by @koto.
-
Set up Travis integration. w3c/trusted-types#51, by @koto.
-
demo.html uses v2 types. w3c/trusted-types#48, by @koto.
-
Added fallback policy support. w3c/trusted-types#46, by @koto.
-
Reduced the size of the polyfill and added build targets for ES 2017 browsers. w3c/trusted-types#45, by @koto.
-
-
20 pull requests merged.
-
Violations will dispatch a SecurityPolicyViolationEvent w3c/trusted-types#71.
-
Small defensive patches. w3c/trusted-types#70.
-
Introduced a 'url-allow-http' keyword to the CSP configuration. w3c/trusted-types#69.
-
Made the compilation more strict. w3c/trusted-types#67.
-
Changing the license to W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE. w3c/trusted-types#62.
-
Allowed functions and null to be assigned to inline event handler attributes w3c/trusted-types#61.
-
Added externs file. w3c/trusted-types#60.
-
Added enforcement for JS types. w3c/trusted-types#59.
-
Added TrustedScript type, w3c/trusted-types#58.
-
Do not make the parsed CSP directives & source expressions lowercase. w3c/trusted-types#57.
-
Added enforcement for additional sinks. w3c/trusted-types#55.
-
TrustedTypes.createPolicy creates a policy that rejects by default. w3c/trusted-types#54.
-
Created a CommonJS build target for node. w3c/trusted-types#53.
-
Added support for whitelisting policy names via CSP. w3c/trusted-types#52.
-
Set up Travis integration. w3c/trusted-types#51.
-
demo.html uses v2 types. w3c/trusted-types#48.
-
Added fallback policy support. w3c/trusted-types#46.
-
Reduced the size of the polyfill and added build targets for ES 2017 browsers. w3c/trusted-types#45.
-
-
1 pull request closed.
-
Experimental fromTemplateLiteral API. w3c/trusted-types#26.
-
-
3 pull requests received 29 new comments.
-
Consolidate common code in `class Trusted*` and create/call policy functions a bit more defensively. w3c/trusted-types#44 (27 comments by @koto, @mikesamuel)
-
Changing the license to W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE. w3c/trusted-types#62 (1 comment by @koto)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
broken link in 3.1. The Clear-Site-Data HTTP Response Header Field w3c/webappsec-clear-site-data#50, by @reschke.
-
-
1 pull request received 1 new comment.
-
Update server file to be used with Python 3 w3c/webappsec-clear-site-data#36 (1 comment by @plehegar)
-
w3c/permissions
-
1 issue received 8 new comments.
-
1 pull request merged.
-
Automation: simplify URI template w3c/permissions#168.
-
-
1 pull request received 3 new comments.
w3c/webappsec-credential-management
-
1 pull request closed.
-
additionalData should handle generic objects w3c/webappsec-credential-management#48.
-
-
2 pull requests received 4 new comments.
-
Use new mixin IDL syntax w3c/webappsec-credential-management#119 (3 comments by @mikewest, @saschanaz)
-
additionalData should handle generic objects w3c/webappsec-credential-management#48 (1 comment by @vabr-g)
-
w3c/webappsec-secure-contexts
-
2 issues received 4 new comments.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (3 comments by @mikewest, @pinobatch)
-
Allow "localhost" as long as it actually resolves to a localhost address w3c/webappsec-secure-contexts#43 (1 comment by @equalsJeffH)
-
w3c/webappsec-csp
-
4 issues opened.
-
I want all links on my website to be rel=noopener w3c/webappsec-csp#316, by @kdzwinel.
-
Clarification of term "parser-inserted" w3c/webappsec-csp#314, by @nikitastupin.
-
Directives fallback is not property setup for inline checks w3c/webappsec-csp#310, by @andypaicu.
-
'strict-dynamic' should not be bound to only nonces/hashes w3c/webappsec-csp#309, by @april.
-
-
2 issues closed.
-
CSP3: Consider adding a 'no-console-log' directive w3c/webappsec-csp#217.
-
worklet-src directive needed for worklets? w3c/webappsec-csp#203.
-
-
6 issues received 12 new comments.
-
CSP3: Consider adding a 'no-console-log' directive w3c/webappsec-csp#217 (5 comments by @april, @borischen, @domfarolino, @michaelficarra)
-
Any protection against dynamic module import? w3c/webappsec-csp#243 (3 comments by @koto, @mikesamuel)
-
Add directive similar to `X-Content-Type-Options: nosniff`? w3c/webappsec-csp#298 (1 comment by @martinzhou2015)
-
-
4 pull requests opened.
-
Update web-platform-tests URLs w3c/webappsec-csp#315, by @foolip.
-
Un-deprecated child-src w3c/webappsec-csp#313, by @andypaicu.
-
[Dropped] Un-deprecated child-src w3c/webappsec-csp#312, by @andypaicu.
-
Wrote necessary spec changes for 'unsafe-hashed-attributes' w3c/webappsec-csp#311, by @andypaicu.
-
-
2 pull requests merged.
-
Wrote necessary spec changes for 'unsafe-hashed-attributes' w3c/webappsec-csp#311.
-
Update web-platform-tests URLs w3c/webappsec-csp#315.
-
-
2 pull requests closed.
-
[Dropped] Un-deprecated child-src w3c/webappsec-csp#312.
-
Add extra note for 'unsafe-hashed-attributes' to address backwards co… w3c/webappsec-csp#247.
-
-
5 pull requests received 15 new comments.
-
Wrote necessary spec changes for 'unsafe-hashed-attributes' w3c/webappsec-csp#311 (6 comments by @andypaicu, @mikewest)
-
Add extra note for 'unsafe-hashed-attributes' to address backwards co… w3c/webappsec-csp#247 (1 comment by @andypaicu)
w3c/webappsec
-
2 issues closed.
-
'strict-dynamic' should not be bound to only nonces/hashes w3c/webappsec#534.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139.
-
-
2 issues received 6 new comments.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (4 comments by @annevk, @baptx, @kdzwinel)
-
'strict-dynamic' should not be bound to only nonces/hashes w3c/webappsec#534 (2 comments by @annevk, @april)
-
w3c/webcrypto
-
2 issues received 14 new comments.
-
Problems with ECDH deriveBits/deriveKey operations w3c/webcrypto#193 (12 comments by @jimsch, @LiraNuna, @NeilMadden)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @acdha, @antonin-arquey)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Update web-platform-tests URLs w3c/webappsec-referrer-policy#113, by @foolip.
-
-
1 pull request merged.
-
Update web-platform-tests URLs w3c/webappsec-referrer-policy#113.
-
w3c/webappsec-fetch-metadata
-
1 issue received 1 new comment.
Participants
-
1 organization left.
-
X left.
-
GitHub
w3c/trusted-types
-
2 issues opened.
-
Consider metadata API; building blocks for HTML sanitizers w3c/trusted-types#43, by @xtofian.
-
How to handle <template>? w3c/trusted-types#42, by @xtofian.
-
-
1 issue received 1 new comment.
-
4 pull requests opened.
-
Removed the v1 API and migrated the code to the v2 policy-centric draft. w3c/trusted-types#41, by @koto.
-
Fixed the exposed policies behavior in the built v2. w3c/trusted-types#40, by @koto.
-
Added tests. w3c/trusted-types#39, by @koto.
-
Added TrustedTypes v2 draft API structured around creating policies. w3c/trusted-types#38, by @koto.
-
-
4 pull requests merged.
-
Removed the v1 API and migrated the code to the v2 policy-centric draft. w3c/trusted-types#41.
-
Fixed the exposed policies behavior in the built v2. w3c/trusted-types#40.
-
Added tests. w3c/trusted-types#39.
-
Added TrustedTypes v2 draft API structured around creating policies. w3c/trusted-types#38.
-
w3c/webappsec-csp
-
2 issues opened.
-
BackSwap type of attack w3c/webappsec-csp#308, by @AliceWonderMiscreations.
-
Update comment of directive value parsing w3c/webappsec-csp#307, by @andypaicu.
-
-
4 issues received 14 new comments.
-
frame-src, worker-src, child-src confusion w3c/webappsec-csp#299 (6 comments by @andypaicu, @annevk, @zbjornson)
-
CSP 4 feature request: cookie policy w3c/webappsec-csp#301 (4 comments by @AliceWonderMiscreations, @dveditz, @Malvoz)
-
Update comment of directive value parsing w3c/webappsec-csp#307 (2 comments by @andypaicu, @mikewest)
-
-
2 pull requests opened.
-
Fixed incorrect quotes in strict-dynamic section w3c/webappsec-csp#306, by @masatokinugawa.
-
Fixed sample code in strict-dynamic section w3c/webappsec-csp#305, by @masatokinugawa.
-
-
2 pull requests merged.
-
Fixed incorrect quotes in strict-dynamic section w3c/webappsec-csp#306.
-
Fixed sample code in strict-dynamic section w3c/webappsec-csp#305.
-
-
3 pull requests received 11 new comments.
-
Introduce 'webrtc-src'. w3c/webappsec-csp#287 (8 comments by @alvestrand, @annevk, @benjamingr, @lgrahl)
-
Fixed sample code in strict-dynamic section w3c/webappsec-csp#305 (2 comments by @masatokinugawa, @mikewest)
-
Fixed incorrect quotes in strict-dynamic section w3c/webappsec-csp#306 (1 comment by @masatokinugawa)
-
w3c/webappsec-permissions-policy
-
7 issues opened.
-
Feature policy for not messing with scrolling? w3c/webappsec-permissions-policy#171, by @kenchris.
-
Policies based on device criteria w3c/webappsec-permissions-policy#169, by @robinglen.
-
Feature-Identifier value for WebAuthn? w3c/webappsec-permissions-policy#168, by @equalsJeffH.
-
Delineate relationship between Feature Policy and Origin Policy w3c/webappsec-permissions-policy#167, by @equalsJeffH.
-
Delineate relationship between Feature Policy and Permissions w3c/webappsec-permissions-policy#166, by @equalsJeffH.
-
Proposal: Parameterized features w3c/webappsec-permissions-policy#163, by @clelland.
-
Disable cross-origin features on sandboxed pages w3c/webappsec-permissions-policy#162, by @devd.
-
-
2 issues closed.
-
Feature Proposal: vertical-scroll w3c/webappsec-permissions-policy#139.
-
Content Performance Policy w3c/webappsec-permissions-policy#141.
-
-
5 issues received 10 new comments.
-
Delineate relationship between Feature Policy and Origin Policy w3c/webappsec-permissions-policy#167 (4 comments by @annevk, @clelland, @mikewest)
-
Feature policy for not messing with scrolling? w3c/webappsec-permissions-policy#171 (2 comments by @clelland, @ehsan-karamad)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (2 comments by @colinbendell, @igrigorik)
-
[TAG] New Registry; Strategy for Updates? w3c/webappsec-permissions-policy#75 (1 comment by @equalsJeffH)
-
Disable cross-origin features on sandboxed pages w3c/webappsec-permissions-policy#162 (1 comment by @annevk)
-
-
4 pull requests opened.
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#170, by @clelland.
-
Break the circular definitions w3c/webappsec-permissions-policy#165, by @clelland.
-
Clarify what allowusermedia actually does. w3c/webappsec-permissions-policy#164, by @clelland.
-
Add info for policies mentioned in seamless web talk w3c/webappsec-permissions-policy#161, by @drufball.
-
-
3 pull requests merged.
-
Edit the implementation detail for `touch-action` w3c/webappsec-permissions-policy#160.
-
Break the circular definitions w3c/webappsec-permissions-policy#165.
-
Add info for policies mentioned in seamless web talk w3c/webappsec-permissions-policy#161.
-
-
1 pull request reopened.
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#170, by @clelland.
-
-
5 pull requests received 28 new comments.
-
Break the circular definitions w3c/webappsec-permissions-policy#165 (16 comments by @annevk, @clelland)
-
Added explainer for optimize image policies w3c/webappsec-permissions-policy#156 (4 comments by @annevk, @igrigorik)
-
Clarify what allowusermedia actually does. w3c/webappsec-permissions-policy#164 (3 comments by @annevk, @clelland)
-
Add info for policies mentioned in seamless web talk w3c/webappsec-permissions-policy#161 (3 comments by @clelland, @drufball, @yoavweiss)
-
Support propagating feature policy in popups. w3c/webappsec-permissions-policy#170 (2 comments by @clelland)
-
w3c/webappsec-subresource-integrity
-
1 pull request closed.
-
[WIP] Fix #68 : integrity for downloads w3c/webappsec-subresource-integrity#78.
-
w3c/webappsec-referrer-policy
-
1 issue closed.
-
Why no referrerpolicy="" on <script>? w3c/webappsec-referrer-policy#96.
-
-
1 issue received 2 new comments.
-
Why no referrerpolicy="" on <script>? w3c/webappsec-referrer-policy#96 (2 comments by @domfarolino, @king7777)
-
w3c/webappsec-clear-site-data
-
2 issues opened.
-
how should outstanding file-backed blobs be handled when site data is cleared? w3c/webappsec-clear-site-data#49, by @wanderview.
-
Ordering of the list of browsing contexts w3c/webappsec-clear-site-data#48, by @bakulf.
-
-
1 issue received 1 new comment.
-
how should outstanding file-backed blobs be handled when site data is cleared? w3c/webappsec-clear-site-data#49 (1 comment by @annevk)
-
w3c/webappsec-fetch-metadata
-
2 issues opened.
-
Name suggestions w3c/webappsec-fetch-metadata#2, by @craigfrancis.
-
Sec-Metadata vs CORS w3c/webappsec-fetch-metadata#1, by @dhausknecht.
-
-
1 issue closed.
-
Sec-Metadata vs CORS w3c/webappsec-fetch-metadata#1.
-
-
2 issues received 14 new comments.
-
Name suggestions w3c/webappsec-fetch-metadata#2 (6 comments by @craigfrancis, @dveditz, @Jxck, @mikewest)
w3c/permissions
-
4 issues opened.
-
describe implicitly-granted (chooser-based) permissions w3c/permissions#178, by @dbaron.
-
Clarify/resolve relationship of PermissionName enum values to Feature Identifier values w3c/permissions#177, by @equalsJeffH.
-
Delineate relationship between Permissions and Feature Policy w3c/permissions#176, by @equalsJeffH.
-
Clipboard permissions w3c/permissions#175, by @martinthomson.
-
-
1 issue closed.
-
Add optional consent due to GDPR w3c/permissions#169.
-
-
4 issues received 7 new comments.
-
describe implicitly-granted (chooser-based) permissions w3c/permissions#178 (3 comments by @clelland, @jyasskin)
-
Using Web IDL to describe WebDriver JSON is a bit unusual w3c/permissions#174 (2 comments by @foolip, @jyasskin)
-
w3c/webappsec-credential-management
-
1 issue closed.
-
Update WebIDL definition(s) to use new mixin syntax w3c/webappsec-credential-management#111.
-
-
2 issues received 3 new comments.
-
Update WebIDL definition(s) to use new mixin syntax w3c/webappsec-credential-management#111 (2 comments by @marcoscaceres)
-
Find a way to avoid exposing a user password to the web page w3c/webappsec-credential-management#96 (1 comment by @backkem)
-
-
1 pull request opened.
-
Use new mixin IDL syntax w3c/webappsec-credential-management#119, by @saschanaz.
-
-
1 pull request merged.
-
Use new mixin IDL syntax w3c/webappsec-credential-management#119.
-
-
2 pull requests received 3 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (2 comments by @mikewest)
-
w3c/webcrypto
-
5 issues closed.
-
Do not mandate secure context for SubtleCrypto w3c/webcrypto#170.
-
Update Webidl to use WindowOrWorkerGlobalScope ? w3c/webcrypto#189.
-
Will this spec accept a pull request? w3c/webcrypto#181.
-
Update WebIDL definition(s) to use new mixin syntax w3c/webcrypto#191.
-
-
9 issues received 10 new comments.
-
Should window.crypto be specified to be non-configurable and non-writable? w3c/webcrypto#169 (2 comments by @jimsch, @plehegar)
-
window.crypto.subtle.importKey not working for me when i hosted my web app on Server (IIS or NodeJs) w3c/webcrypto#192 (1 comment by @plehegar)
-
-
7 pull requests opened.
-
window.crypto returns the same object w3c/webcrypto#206, by @plehegar.
-
SHA algorithms aren't defined in this spec w3c/webcrypto#205, by @plehegar.
-
Update in 33.2. Symmetric Encryption example - w3c/webcrypto#204, by @plehegar.
-
Move an extended attribute to annotate types w3c/webcrypto#202, by @plehegar.
-
Minor typo w3c/webcrypto#201, by @plehegar.
-
Use partial WindowOrWorkerGlobalScope w3c/webcrypto#200, by @saschanaz.
-
-
5 pull requests merged.
-
Move an extended attribute to annotate types w3c/webcrypto#202.
-
Minor typo w3c/webcrypto#201.
-
Use partial WindowOrWorkerGlobalScope w3c/webcrypto#200.
-
Use Web IDL's new-ish interface mixins concept w3c/webcrypto#194.
-
3 pull requests closed.
-
Move an extended attribute to annotate types w3c/webcrypto#199.
-
Fix minor typo w3c/webcrypto#197.
-
4 pull requests received 5 new comments.
-
Use Web IDL's new-ish interface mixins concept w3c/webcrypto#194 (2 comments by @marcoscaceres, @plehegar)
-
Fix reference to `plaintext` variable in AES-GCM decrypt algorithm description w3c/webcrypto#188 (1 comment by @plehegar)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Should loopback and other trusted urls be upgraded? w3c/webappsec-upgrade-insecure-requests#14, by @jonathanKingston.
-
-
1 issue received 6 new comments.
-
Should loopback and other trusted urls be upgraded? w3c/webappsec-upgrade-insecure-requests#14 (6 comments by @annevk, @foolip, @jonathanKingston, @mikewest)
-
w3c/webappsec-secure-contexts
-
1 issue received 5 new comments.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (5 comments by @curry684, @daurnimator, @jpiesing, @pinobatch)
-
GitHub
w3c/webappsec-csp
-
5 issues opened.
-
Consider dot-prefix domains for wildcard matching w3c/webappsec-csp#304, by @007.
-
Grammar: Clarity regarding constraints applied to path-part (path-absolute) production w3c/webappsec-csp#303, by @bathos.
-
Prefetch-src are we allowed to use it yet? w3c/webappsec-csp#302, by @ghost.
-
CSP 4 feature request: cookie policy w3c/webappsec-csp#301, by @AliceWonderMiscreations.
-
Directive to disallow external entities in SVG/XML? w3c/webappsec-csp#300, by @Malvoz.
-
-
1 issue closed.
-
Prefetch-src are we allowed to use it yet? w3c/webappsec-csp#302.
-
-
1 issue reopened.
-
Add note about the importance of preventing nonce exfiltration/reuse w3c/webappsec-csp#258, by @annevk.
-
-
9 issues received 12 new comments.
-
CSP 4 feature request: cookie policy w3c/webappsec-csp#301 (3 comments by @AliceWonderMiscreations, @annevk, @dveditz)
-
Add note about the importance of preventing nonce exfiltration/reuse w3c/webappsec-csp#258 (2 comments by @andypaicu, @arturjanc)
-
-
2 pull requests received 2 new comments.
-
Add extra note for 'unsafe-hashed-attributes' to address backwards co… w3c/webappsec-csp#247 (1 comment by @andypaicu)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Explicit export/definition for "payment" w3c/webappsec-permissions-policy#154, by @marcoscaceres.
-
-
4 issues received 12 new comments.
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (6 comments by @arturjanc, @clelland, @yoavweiss)
-
Layout Performance/Complexity Policy w3c/webappsec-permissions-policy#143 (4 comments by @developit, @Malvoz)
-
-
4 pull requests opened.
-
Edit the implementation detail for `touch-action` w3c/webappsec-permissions-policy#160, by @ehsan-karamad.
-
Adding explainer for unsized media policy w3c/webappsec-permissions-policy#157, by @loonybear.
-
Added explainer for optimize image policies w3c/webappsec-permissions-policy#156, by @loonybear.
-
Explainer for 'vertical-scroll' policy. w3c/webappsec-permissions-policy#155, by @ehsan-karamad.
-
-
3 pull requests merged.
-
Adding explainer for unsized media policy w3c/webappsec-permissions-policy#157.
-
Added explainer for optimize image policies w3c/webappsec-permissions-policy#156.
-
Explainer for 'vertical-scroll' policy. w3c/webappsec-permissions-policy#155.
-
-
4 pull requests received 11 new comments.
-
Explainer for 'vertical-scroll' policy. w3c/webappsec-permissions-policy#155 (6 comments by @clelland, @ehsan-karamad, @plehegar, @yoavweiss)
-
Added explainer for optimize image policies w3c/webappsec-permissions-policy#156 (3 comments by @clelland, @yoavweiss)
-
Edit the implementation detail for `touch-action` w3c/webappsec-permissions-policy#160 (1 comment by @yoavweiss)
-
Adding explainer for unsized media policy w3c/webappsec-permissions-policy#157 (1 comment by @clelland)
-
w3c/permissions
-
2 issues opened.
-
Using Web IDL to describe WebDriver JSON is a bit unusual w3c/permissions#174, by @foolip.
-
Possibly add 'vibration' to Permission Registry Enum? w3c/permissions#173, by @qdot.
-
-
1 issue closed.
-
autoplay permission w3c/permissions#172.
-
-
3 issues received 8 new comments.
-
Using Web IDL to describe WebDriver JSON is a bit unusual w3c/permissions#174 (4 comments by @domenic, @foolip, @jugglinmike)
-
-
1 pull request received 2 new comments.
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163 (2 comments by @jyasskin)
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
w3c/webappsec
-
1 issue closed.
-
CSP: Consider dot-prefix domains for wildcard matching w3c/webappsec#513.
-
-
2 issues received 2 new comments.
w3c/webappsec-suborigins
-
1 issue opened.
-
Document how Referrer Policy would work with suborigins w3c/webappsec-suborigins#80, by @jeremylong.
-
-
1 issue received 1 new comment.
-
Document how Referrer Policy would work with suborigins w3c/webappsec-suborigins#80 (1 comment by @devd)
-
w3c/webcrypto
-
1 issue received 1 new comment.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @lll000111)
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
1 pull request opened.
-
Use JavaScript instead of Javascript w3c/trusted-types#37, by @vrana.
-
-
1 pull request merged.
-
Use JavaScript instead of Javascript w3c/trusted-types#37.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60, by @daurnimator.
-
-
1 issue received 1 new comment.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (1 comment by @pinobatch)
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
Participants
-
1 participant joined.
-
Michael Specter (W3C Invited Experts) joined.
-
GitHub
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
A new IntegrityCheckFailure event w3c/webappsec-subresource-integrity#77, by @ScottHelme.
-
-
5 issues received 9 new comments.
-
integrity for downloads w3c/webappsec-subresource-integrity#68 (3 comments by @annevk, @riking, @tdelmas)
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (2 comments by @BigBlueHat, @kevincox)
-
A new IntegrityCheckFailure event w3c/webappsec-subresource-integrity#77 (2 comments by @mozfreddyb, @ScottHelme)
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20 (1 comment by @ScottHelme)
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @BigBlueHat)
-
-
1 pull request opened.
-
[WIP] Fix #68 : integrity for downloads w3c/webappsec-subresource-integrity#78, by @tdelmas.
-
w3c/webappsec-secure-contexts
-
3 issues opened.
-
Typo: "Intergration with WebIDL" w3c/webappsec-secure-contexts#59, by @stpeter.
-
"Is an environment settings object contextually secure?" does not work for worklets w3c/webappsec-secure-contexts#57, by @annevk.
-
"Is an environment settings object contextually secure?" does not deal with nested workers w3c/webappsec-secure-contexts#56, by @annevk.
-
-
1 issue closed.
-
Should secure iframes of insecure parents be considered secure? Spec is self-contradictory. w3c/webappsec-secure-contexts#54.
-
-
1 issue received 2 new comments.
-
"Is an environment settings object contextually secure?" does not deal with nested workers w3c/webappsec-secure-contexts#56 (2 comments by @bzbarsky)
-
-
1 pull request merged.
-
Reintroduce the dependency on a parent's security. w3c/webappsec-secure-contexts#55.
-
-
1 pull request received 3 new comments.
-
Reintroduce the dependency on a parent's security. w3c/webappsec-secure-contexts#55 (3 comments by @annevk, @bzbarsky)
-
w3c/permissions
-
1 issue opened.
-
autoplay permission w3c/permissions#172, by @cpearce.
-
-
1 issue received 3 new comments.
-
1 pull request received 2 new comments.
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163 (2 comments by @jan-ivar, @raymeskhoury)
-
w3c/webappsec-csp
-
1 issue opened.
-
frame-src, worker-src, child-src confusion w3c/webappsec-csp#299, by @AliceWonderMiscreations.
-
-
1 issue closed.
-
Allow navigation to only whitelisted URLs via navigate-to w3c/webappsec-csp#125.
-
-
6 issues received 8 new comments.
-
Allow nonce-source to be used in more directives. w3c/webappsec-csp#116 (3 comments by @dveditz, @frederikbosch)
-
The `disown-opener` directive is not the right model w3c/webappsec-csp#194 (1 comment by @AliceWonderMiscreations)
-
Add a new directive governing the use of http-equiv in <meta> tags w3c/webappsec-csp#112 (1 comment by @Gelembjuk)
-
-
1 pull request merged.
-
The `navigate-to` directive w3c/webappsec-csp#290.
-
-
1 pull request received 6 new comments.
-
Introduce 'webrtc-src'. w3c/webappsec-csp#287 (6 comments by @alvestrand, @annevk, @benjamingr, @lgrahl, @patrickkettner)
-
w3c/webcrypto
-
1 issue opened.
-
Type annotation on `RsaKeyGenParams.modulusLength` should be after `require` keyword w3c/webcrypto#198, by @peria.
-
-
1 issue received 2 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @dead-claudia, @jimsch)
-
-
1 pull request opened.
-
Move an extended attribute to annotate types w3c/webcrypto#199, by @peria.
-
w3c/webappsec-permissions-policy
-
9 issues opened.
-
Typo on "allowusermedia" section w3c/webappsec-permissions-policy#153, by @compulim.
-
Editorial: please use safelist instead of whitelist w3c/webappsec-permissions-policy#150, by @annevk.
-
The text suggest Feature Policy is superior because sandbox whitelist approach hurt extensibility w3c/webappsec-permissions-policy#149, by @compulim.
-
commas and semicolons both allowed, with different rules for overriding w3c/webappsec-permissions-policy#148, by @dbaron.
-
spec seems inconsistent about whether 'self' 'src' and 'none' require single quotes around them w3c/webappsec-permissions-policy#147, by @dbaron.
-
allow attribute prose and algorithm don't quite agree w3c/webappsec-permissions-policy#146, by @dbaron.
-
spec should offer a little more explanation for other specification authors w3c/webappsec-permissions-policy#145, by @dbaron.
-
Layout Performance/Complexity Policy w3c/webappsec-permissions-policy#143, by @developit.
-
-
2 issues closed.
-
Editorial: please use safelist instead of whitelist w3c/webappsec-permissions-policy#150.
-
spec seems inconsistent about whether 'self' 'src' and 'none' require single quotes around them w3c/webappsec-permissions-policy#147.
-
-
10 issues received 24 new comments.
-
Editorial: please use safelist instead of whitelist w3c/webappsec-permissions-policy#150 (5 comments by @annevk, @clelland, @jpchase)
-
Feature Proposal: vertical-scroll w3c/webappsec-permissions-policy#139 (5 comments by @clelland, @ehsan-karamad)
-
Feature proposal: sync-xhr w3c/webappsec-permissions-policy#126 (3 comments by @annevk, @clelland, @RByers)
-
allow attribute prose and algorithm don't quite agree w3c/webappsec-permissions-policy#146 (2 comments by @annevk, @clelland)
-
spec should offer a little more explanation for other specification authors w3c/webappsec-permissions-policy#145 (2 comments by @clelland, @dbaron)
-
The text suggest Feature Policy is superior because sandbox whitelist approach hurt extensibility w3c/webappsec-permissions-policy#149 (2 comments by @clelland, @compulim)
-
commas and semicolons both allowed, with different rules for overriding w3c/webappsec-permissions-policy#148 (2 comments by @annevk, @clelland)
-
spec seems inconsistent about whether 'self' 'src' and 'none' require single quotes around them w3c/webappsec-permissions-policy#147 (1 comment by @clelland)
-
Feature Proposal: disallow-animated-gif w3c/webappsec-permissions-policy#137 (1 comment by @developit)
-
-
3 pull requests opened.
-
Clarify use of quotes in declared policies. w3c/webappsec-permissions-policy#152, by @clelland.
-
Remove uses of the term "whitelist" w3c/webappsec-permissions-policy#151, by @clelland.
-
Two typo fixes. w3c/webappsec-permissions-policy#144, by @dbaron.
-
-
3 pull requests merged.
-
Remove uses of the term "whitelist" w3c/webappsec-permissions-policy#151.
-
Clarify use of quotes in declared policies. w3c/webappsec-permissions-policy#152.
-
Two typo fixes. w3c/webappsec-permissions-policy#144.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
1 issue received 2 new comments.
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec-credential-management#3 (2 comments by @apowers313, @mikewest)
-
-
1 pull request received 4 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (4 comments by @equalsJeffH)
-
w3c/trusted-types
-
1 issue received 1 new comment.
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11 (1 comment by @mozfreddyb)
-
Participants
-
1 participant joined.
-
Samuel Weiler (W3C) joined.
-
GitHub
w3c/webappsec-secure-contexts
-
1 pull request received 1 new comment.
-
Reintroduce the dependency on a parent's security. w3c/webappsec-secure-contexts#55 (1 comment by @estark37)
-
w3c/webcrypto
-
1 issue opened.
-
Selected ECC curves are not secure w3c/webcrypto#196, by @obogobo.
-
-
3 issues received 3 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @johnozbay)
-
-
1 pull request opened.
-
Fix minor typo w3c/webcrypto#197, by @k-cybulski.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
5 issues opened.
-
Add directive similar to `X-Content-Type-Options: nosniff`? w3c/webappsec-csp#298, by @valtlai.
-
Expose host in a 'host' source reference w3c/webappsec-csp#297, by @emilfihlman.
-
Remove gh-pages branch? w3c/webappsec-csp#296, by @annevk.
-
NIST URls support https now w3c/webappsec-csp#294, by @edent.
-
Potential wrong sha256 example in 'Hash usage for script elements' w3c/webappsec-csp#292, by @AnujRNair.
-
-
1 issue closed.
-
NIST URls support https now w3c/webappsec-csp#294.
-
-
1 issue reopened.
-
CSP: connect-src 'self' and websockets w3c/webappsec-csp#7, by @annevk.
-
-
7 issues received 20 new comments.
-
Further granularity of unsafe-inline styles w3c/webappsec-csp#45 (7 comments by @arturjanc, @jonathanKingston, @mikewest, @vrastogi)
-
Having problems setting up "worker-src" help pls w3c/webappsec-csp#130 (3 comments by @dveditz, @matthewp)
-
Consider hiding content attribute of meta tag CSP w3c/webappsec-csp#291 (3 comments by @arturjanc, @mikewest, @vrastogi)
-
Allow navigation to only whitelisted URLs via navigate-to w3c/webappsec-csp#125 (2 comments by @annevk, @lubin2010)
-
Add directive similar to `X-Content-Type-Options: nosniff`? w3c/webappsec-csp#298 (1 comment by @jonathanKingston)
-
-
2 pull requests opened.
-
Upgrade to https links w3c/webappsec-csp#295, by @edent.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293, by @eholk.
-
-
1 pull request merged.
-
Upgrade to https links w3c/webappsec-csp#295.
-
-
4 pull requests received 31 new comments.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (16 comments by @andypaicu, @annevk, @domenic, @eholk, @flagxor, @jfbastien, @mikesamuel)
-
w3c/webappsec-permissions-policy
-
4 issues opened.
-
Content Performance Policy w3c/webappsec-permissions-policy#141, by @Malvoz.
-
Feature Proposal: vertical-scroll w3c/webappsec-permissions-policy#139, by @ehsan-karamad.
-
Feature Proposal: disallow-animated-gif w3c/webappsec-permissions-policy#137, by @addyosmani.
-
What's the meaning of the 'Default allowlist' column? w3c/webappsec-permissions-policy#136, by @jpmedley.
-
-
4 issues received 11 new comments.
-
Feature Proposal: disallow-animated-gif w3c/webappsec-permissions-policy#137 (4 comments by @annevk, @clelland, @ojanvafai)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (4 comments by @clelland, @igrigorik, @michael-oneill)
-
What's the meaning of the 'Default allowlist' column? w3c/webappsec-permissions-policy#136 (2 comments by @clelland, @jpmedley)
-
How vibrate will work with Feature Policy given the user gesture requirement? w3c/webappsec-permissions-policy#58 (1 comment by @clelland)
-
-
2 pull requests opened.
-
Remove out-of-date and incorrect ref w3c/webappsec-permissions-policy#140, by @clelland.
-
[Picture-in-Picture] Update default allowlist to * w3c/webappsec-permissions-policy#138, by @beaufortfrancois.
-
-
2 pull requests merged.
-
Remove out-of-date and incorrect ref w3c/webappsec-permissions-policy#140.
-
[Picture-in-Picture] Update default allowlist to * w3c/webappsec-permissions-policy#138.
-
-
2 pull requests received 4 new comments.
-
Remove out-of-date and incorrect ref w3c/webappsec-permissions-policy#140 (2 comments by @annevk, @clelland)
-
[Picture-in-Picture] Update default allowlist to * w3c/webappsec-permissions-policy#138 (2 comments by @beaufortfrancois, @mounirlamouri)
-
w3c/permissions
-
3 issues opened.
-
Preventing blackmail w3c/permissions#171, by @ghost.
-
PermissionStatus's memory management is unclear w3c/permissions#170, by @smaug----.
-
Add optional consent due to GDPR w3c/permissions#169, by @lknik.
-
-
1 issue closed.
-
Preventing blackmail w3c/permissions#171.
-
-
2 issues received 12 new comments.
-
Add optional consent due to GDPR w3c/permissions#169 (4 comments by @dbaron, @johannhof, @raymeskhoury, @tcellaaron)
w3c/webappsec-credential-management
-
1 issue received 1 new comment.
-
Extensibility via "Credential Handlers" w3c/webappsec-credential-management#99 (1 comment by @dlongley)
-
-
1 pull request received 2 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (2 comments by @dlongley, @mikewest)
-
w3c/webappsec-mixed-content
-
1 issue received 5 new comments.
-
What's the scope of mixed content tainting? w3c/webappsec-mixed-content#7 (5 comments by @annevk, @jonathanKingston)
-
w3c/trusted-types
-
7 issues received 14 new comments.
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11 (5 comments by @koto, @mikesamuel, @mozfreddyb)
-
Mechanism to constrain usages of unsafelyCreate w3c/trusted-types#31 (3 comments by @koto, @mikesamuel)
-
Is it possible to lock things down to string constants? w3c/trusted-types#4 (2 comments by @mikesamuel)
-
Consider surfacing sanitization fallbacks to the developer w3c/trusted-types#21 (1 comment by @mikesamuel)
-
w3c/webappsec-cors-for-developers
-
1 pull request opened.
-
Fix header name in index.src.html example code w3c/webappsec-cors-for-developers#9, by @moxley.
-
-
3 pull requests merged.
-
s/gretting/greeting/ w3c/webappsec-cors-for-developers#8.
-
Fix incorrect ACAM header w3c/webappsec-cors-for-developers#6.
-
Fix header name in index.src.html example code w3c/webappsec-cors-for-developers#9.
-
w3c/webappsec-clear-site-data
-
1 issue closed.
-
Clear all option '*' w3c/webappsec-clear-site-data#32.
-
-
3 issues received 3 new comments.
Participants
-
1 organization joined.
-
Brave Software Inc. joined.
-
GitHub
w3c/webappsec-csp
-
7 issues opened.
-
Consider hiding content attribute of meta tag CSP w3c/webappsec-csp#291, by @vrastogi.
-
CSP vulnerability enabling cross-origin session data exfiltration w3c/webappsec-csp#289, by @eligrey.
-
Wrong url on example 6 w3c/webappsec-csp#286, by @murillo128.
-
`prerender` subresources and CSP w3c/webappsec-csp#284, by @yoavweiss.
-
Allow control over `dns-prefetch` and `preconnect` w3c/webappsec-csp#282, by @annevk.
-
bikeshed: LINK ERROR: No 'idl' refs found for 'nonce' with for='NoncedElement' w3c/webappsec-csp#281, by @sideshowbarker.
-
Sandbox directive for workers w3c/webappsec-csp#279, by @aliams.
-
-
11 issues closed.
-
CSP vulnerability enabling cross-origin session data exfiltration w3c/webappsec-csp#289.
-
Specify behavior of prefetch requests w3c/webappsec-csp#107.
-
A kind of a nonce for a complete "zone" w3c/webappsec-csp#245.
-
Year of CSP3 is 2016 w3c/webappsec-csp#244.
-
Permission for browser extensions w3c/webappsec-csp#232.
-
Add <base target="x" /> to CSP w3c/webappsec-csp#186.
-
Permit blocking of certain hosts w3c/webappsec-csp#100.
-
Prevent nonce stealing by looking for "<script" in attributes of nonced scripts w3c/webappsec-csp#98.
-
Allow report-uri in meta tags. w3c/webappsec-csp#278.
-
Consider not exposing nonce="" to the page w3c/webappsec-csp#65.
-
-
1 issue reopened.
-
Relax CSP source path matching when response is replaced by service worker e.g. redirects w3c/webappsec-csp#261, by @annevk.
-
-
25 issues received 89 new comments.
-
Specify behavior of prefetch requests w3c/webappsec-csp#107 (15 comments by @april, @eligrey, @igrigorik, @michaelficarra, @mikewest, @paulcalvano, @ri0t, @ScottHelme, @yoavweiss)
-
WebRTC can be used for exfiltration w3c/webappsec-csp#92 (12 comments by @alvestrand, @martinthomson, @mikewest, @murillo128, @steely-glint)
-
`prerender` subresources and CSP w3c/webappsec-csp#284 (11 comments by @annevk, @mikewest, @yoavweiss)
-
Allow report-uri in meta tags. w3c/webappsec-csp#278 (9 comments by @andypaicu, @annevk, @mikewest, @ScottHelme)
-
Allow CSP-Report-Only in meta tags. w3c/webappsec-csp#277 (6 comments by @andypaicu, @arturjanc, @dhausknecht, @mikewest, @ScottHelme)
-
Allow control over `dns-prefetch` and `preconnect` w3c/webappsec-csp#282 (4 comments by @annevk, @mikewest)
-
Relax CSP source path matching when response is replaced by service worker e.g. redirects w3c/webappsec-csp#261 (3 comments by @aliams, @andypaicu, @annevk)
-
Hash encodings should be converted to UTF-8 w3c/webappsec-csp#109 (3 comments by @andypaicu, @annevk)
-
Consider hiding content attribute of meta tag CSP w3c/webappsec-csp#291 (2 comments by @annevk, @vrastogi)
-
CSP vulnerability enabling cross-origin session data exfiltration w3c/webappsec-csp#289 (2 comments by @albinowax, @eligrey)
-
Allow navigation to only whitelisted URLs via navigate-to w3c/webappsec-csp#125 (2 comments by @eligrey)
-
Consider not exposing nonce="" to the page w3c/webappsec-csp#65 (2 comments by @andypaicu, @mikewest)
-
Add note about the importance of preventing nonce exfiltration/reuse w3c/webappsec-csp#258 (1 comment by @andypaicu)
-
Prevent nonce stealing by looking for "<script" in attributes of nonced scripts w3c/webappsec-csp#98 (1 comment by @andypaicu)
-
Consider providing a way to tighten source-expressions that contain `self` w3c/webappsec-csp#91 (1 comment by @andypaicu)
-
CSP Violation Reports for redirects should include full original URI and origins in the redirect URIs w3c/webappsec-csp#86 (1 comment by @andypaicu)
-
Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. w3c/webappsec-csp#255 (1 comment by @mikewest)
-
-
6 pull requests opened.
-
The `navigate-to` directive w3c/webappsec-csp#290, by @andypaicu.
-
Fix a typo and grammatical error in prefetch-src w3c/webappsec-csp#288, by @april.
-
Introduce 'webrtc-src'. w3c/webappsec-csp#287, by @mikewest.
-
Fix for bikeshed linking error w3c/webappsec-csp#285, by @andypaicu.
-
Introduce 'prefetch-src'. Closes w3c/webappsec-csp#107. w3c/webappsec-csp#283, by @mikewest.
-
Fix a few typos w3c/webappsec-csp#280, by @sideshowbarker.
-
-
3 pull requests merged.
-
Fix a typo and grammatical error in prefetch-src w3c/webappsec-csp#288.
-
Fix a few typos w3c/webappsec-csp#280.
-
Introduce 'prefetch-src'. Closes w3c/webappsec-csp#107. w3c/webappsec-csp#283.
-
-
1 pull request closed.
-
Make the example for multiple policies a little clearer w3c/webappsec-csp#76.
-
-
5 pull requests received 52 new comments.
-
Introduce 'webrtc-src'. w3c/webappsec-csp#287 (16 comments by @alvestrand, @martinthomson, @michaelficarra, @mikewest, @murillo128)
-
Introduce 'prefetch-src'. Closes w3c/webappsec-csp#107. w3c/webappsec-csp#283 (14 comments by @annevk, @mikewest, @yoavweiss)
-
w3c/webappsec-permissions-policy
-
5 issues opened.
-
Feature Proposal: cross-origin rootBounds and rootMargin w3c/webappsec-permissions-policy#132, by @clelland.
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129, by @igrigorik.
-
Feature proposal: sync-xhr w3c/webappsec-permissions-policy#126, by @clelland.
-
Replace "feature name" with "identifier" or similar w3c/webappsec-permissions-policy#125, by @clelland.
-
Ensure that 'self' in feature policy syntax is compatible with CSP w3c/webappsec-permissions-policy#124, by @clelland.
-
-
2 issues closed.
-
Replace "feature name" with "identifier" or similar w3c/webappsec-permissions-policy#125.
-
allowlist type w3c/webappsec-permissions-policy#105.
-
-
3 issues received 10 new comments.
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (4 comments by @arturjanc, @clelland, @igrigorik)
-
Replace "feature name" with "identifier" or similar w3c/webappsec-permissions-policy#125 (3 comments by @annevk, @clelland)
-
-
5 pull requests opened.
-
Fix several bikeshed linking errors w3c/webappsec-permissions-policy#134, by @clelland.
-
Remove outdated references to 'global' w3c/webappsec-permissions-policy#133, by @clelland.
-
Remove feature name w3c/webappsec-permissions-policy#131, by @clelland.
-
Fix some bikeshed errors w3c/webappsec-permissions-policy#130, by @clelland.
-
Remove exitPictureInPicture in picture-in-picture FP w3c/webappsec-permissions-policy#128, by @beaufortfrancois.
-
-
6 pull requests merged.
-
Fix several bikeshed linking errors w3c/webappsec-permissions-policy#134.
-
Remove feature name w3c/webappsec-permissions-policy#131.
-
Remove outdated references to 'global' w3c/webappsec-permissions-policy#133.
-
Fix some bikeshed errors w3c/webappsec-permissions-policy#130.
-
Remove exitPictureInPicture in picture-in-picture FP w3c/webappsec-permissions-policy#128.
-
Update description and definition of allowlist. w3c/webappsec-permissions-policy#123.
-
-
2 pull requests received 2 new comments.
-
Remove exitPictureInPicture in picture-in-picture FP w3c/webappsec-permissions-policy#128 (1 comment by @clelland)
w3c/webappsec-subresource-integrity
-
1 issue received 4 new comments.
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26 (4 comments by @annevk, @guybedford, @jyasskin, @mikewest)
-
w3c/webcrypto
-
1 issue opened.
-
Support for window.crypto.signText w3c/webcrypto#195, by @jasp00.
-
-
3 issues received 4 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @JulianKlug)
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Should secure iframes of insecure parents be considered secure? Spec is self-contradictory. w3c/webappsec-secure-contexts#54, by @bzbarsky.
-
-
1 issue closed.
-
Error msg (https://goo.gl/Y0ZkNV) instead of giving the latitude and longitude w3c/webappsec-secure-contexts#53.
-
-
2 issues received 4 new comments.
-
Should secure iframes of insecure parents be considered secure? Spec is self-contradictory. w3c/webappsec-secure-contexts#54 (3 comments by @bzbarsky, @mikewest, @travisleithead)
-
Error msg (https://goo.gl/Y0ZkNV) instead of giving the latitude and longitude w3c/webappsec-secure-contexts#53 (1 comment by @annevk)
-
-
1 pull request opened.
-
Reintroduce the dependency on a parent's security. w3c/webappsec-secure-contexts#55, by @mikewest.
-
-
1 pull request received 1 new comment.
-
Reintroduce the dependency on a parent's security. w3c/webappsec-secure-contexts#55 (1 comment by @mikewest)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Shouldn't be touching settings objects in parallel w3c/webappsec-credential-management#118, by @bzbarsky.
-
-
1 issue received 1 new comment.
-
Extensibility via "Credential Handlers" w3c/webappsec-credential-management#99 (1 comment by @dlongley)
-
w3c/permissions
-
1 issue opened.
-
The boolean permission query algorithm isn't Boolean w3c/permissions#167, by @martinthomson.
-
-
2 issues received 7 new comments.
-
A new permission for canvas data w3c/permissions#165 (5 comments by @KOLANICH, @tabatkins, @tomrittervg)
-
The boolean permission query algorithm isn't Boolean w3c/permissions#167 (2 comments by @jyasskin, @martinthomson)
-
-
1 pull request opened.
-
Automation: simplify URI template w3c/permissions#168, by @jugglinmike.
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
2 issues received 2 new comments.
w3c/webappsec-clear-site-data
-
1 issue closed.
-
Regenerate https://www.w3.org/TR/clear-site-data/ w3c/webappsec-clear-site-data#39.
-
-
1 issue received 1 new comment.
-
Regenerate https://www.w3.org/TR/clear-site-data/ w3c/webappsec-clear-site-data#39 (1 comment by @msramek)
-
-
2 pull requests opened.
-
Migrated the performance demo to appengine. w3c/webappsec-clear-site-data#47, by @msramek.
-
Added data type selection. w3c/webappsec-clear-site-data#46, by @msramek.
-
-
3 pull requests merged.
-
Fix typos w3c/webappsec-clear-site-data#41.
-
Migrated the performance demo to appengine. w3c/webappsec-clear-site-data#47.
-
Added data type selection. w3c/webappsec-clear-site-data#46.
-
-
2 pull requests received 3 new comments.