w3c/webappsec-csp Issues

Last updated Dec 22, 2024, 5:57:07 AM UTC.

This repository doesn't have the Priority: Eventually label that's used to mark an issue as triaged without giving it an SLO. Until that's added, this summary uses heuristics to guess if each issue has been triaged.

42 out-of-SLO untriaged issues
3 issues on the agenda

Untriaged

Try to triage issues within 7 days. [ More Info ]

Issue	Title	Within SLO	On maintainers' plates for	Time past SLO
#226	Prefer blocking fall-through conditions	❌	7.4 years	7.4 years
#235	Should frame-src control frames with "local scheme"?	❌	7.3 years	7.3 years
#252	What I am doing wrong on this script-src	❌	7.2 years	7.2 years
#292	Potential wrong sha256 example in 'Hash usage for script elements'	❌	6.9 years	6.8 years
#297	Expose host in a 'host' source reference	❌	6.8 years	6.8 years
#314	Clarification of term "parser-inserted"	❌	6.5 years	6.5 years
#384	policy's self-origin for CSP policies inserted by <meta>	❌	5.9 years	5.8 years
#387	http-equiv delivery method: recommend to set after <meta charset="utf-8">?	❌	5.8 years	5.8 years
#388	Is CSPViolationReportBody a funny name?	❌	5.8 years	5.8 years
#396	Use of "Get the effective directive for inline checks" in "Should navigation request of type from source in target be blocked by Content Security Policy?" doesn't seem to make sense	❌	5.6 years	5.6 years
#397	Header parsing and integration with Fetch	❌	5.6 years	5.6 years
#401	Define interaction between script-src / trusted-types	❌	5.5 years	5.5 years
#406	Conflict in CSP reporting specs on nullable fields	❌	5.4 years	5.3 years
#408	Update spec to new IDL syntax for optional dictionaries	❌	5.3 years	5.3 years
#409	Update to constructor operations	❌	5.3 years	5.3 years
#416	Add version number to allow 'non-backwards compatible' CSP[version]-mode	❌	5 years	5 years
#421	Inconsistent behavior of frame-ancestors versus implementations	❌	4.8 years	4.8 years
#428	`unsafe-allow-redirects` and `form-action` interact weirdly	❌	4.8 years	4.7 years
#432	Clarify that report-uri cannot violate mixed-content	❌	4.7 years	4.6 years
#440	host-part matching should allow IPv6 "[::1]" as it does for "127.0.0.1"	❌	4.4 years	4.4 years
#442	Document that line-number and column-number are 1-based in CSP reporting spec	❌	4.3 years	4.2 years
#514	Content-Security-Policy header isn't registered	❌	3.2 years	3.2 years
#521	Editorial: header names and values are byte sequences	❌	3.2 years	3.1 years
#524	should-block-response doesn't forward arguments	❌	3.1 years	3.1 years
#556	Correct the link for CSP3 in the CSP2 Page	❌	2.5 years	2.4 years
#581	Remove initialization hook	❌	2.1 years	2 years
#610	CSP: Embedded Enforcement Links for issue 16 and 17 are dead	❌	1.5 years	1.4 years
#624	frame-src using the fetch instead of the navigational check - can end up checking the wrong policies	❌	1.1 years	1.1 years
#632	Some way to allow workers other than URL and strict-dynamic	❌	1 year	11.9 months
#635	Does "Is Element Nonceable" apply to non-inline scripts?	❌	11.3 months	11.1 months
#638	`service-worker-src` directive	❌	11.2 months	11 months
#643	"Is element nonceable" not applied to non-<script> elements in Chrome?	❌	10.3 months	10.1 months
#673	CSP spec not user-friendly	❌	5 months	4.8 months
#674	Consider using SecurityPolicyViolationEvent.sourceFile a USVString	❌	4.7 months	4.5 months
#679	Feedback request on not capturing the caller in `new Function` and indirect `eval`	❌	3.6 months	3.4 months
#680	port-part being null is not handled	❌	3.3 months	3 months
#687	Should "Should navigation request of type be blocked by Content Security Policy?" set the violation object's element?	❌	1.9 months	1.7 months
#690	Consider recommending the usage of events instead of CSP reports for CSP WPTs	❌	1.1 months	3.7 weeks
#694	Allow RFC3986 scheme relative URIs in host-source	❌	3.5 weeks	2.5 weeks
#696	https://w3c.github.io/webappsec-csp/#report-violation invokes "Queue a task" without passing a task source	❌	2.8 weeks	1.8 weeks
#697	EnsureCSPDoesNotBlockStringCompilation: Explain why we need to check TrustedScript's data (and add tests)	❌	2.5 weeks	1.5 weeks
#698	EnsureCSPDoesNotBlockStringCompilation: calling "Get Trusted Type compliant string"	❌	2.5 weeks	1.5 weeks

Agenda

Try to maintain fewer than 25 agenda items and discuss issues on the agenda within 35 days. [ More Info ] [ See these issues on Github ]

Issue	Title	Within SLO	On the agenda for	Time left
#425	Clarify that integrity metadata must be non-empty	✔	5 days	4.2 weeks
#424	Use correct set of source expressions in script directives pre-request check	✔	5 days	4.2 weeks
#523	Hashes bypass source-based allowlisting only on pre-request, not on post-request	✔	5 days	1 month