w3c/webappsec-cspee Issues

Last updated May 18, 2024, 5:57:13 AM UTC.

This repository doesn't have the Priority: Eventually label that's used to mark an issue as triaged without giving it an SLO. Until that's added, this summary uses heuristics to guess if each issue has been triaged.

19 out-of-SLO untriaged issues

Untriaged

Try to triage issues within 7 days. [ More Info ]

Issue	Title	Within SLO	On maintainers' plates for	Time past SLO
#1	How is CSPEE recursive?	❌	5.6 years	5.6 years
#2	Embedded: make clear that servers MUST respond with a CSP or Allow-CSP-From header, <meta> CSP's are not allowed.	❌	5.6 years	5.6 years
#3	Embedding-CSP header	❌	5.6 years	5.6 years
#4	Embedded: consider other contexts other than iframe	❌	5.6 years	5.6 years
#5	Clarify what is the threat model for embedded enforcement	❌	5.6 years	5.6 years
#6	Embedded Enforcement: Invalid required csp attribute on iframe	❌	5.6 years	5.6 years
#7	Embedded: Think about the implications of allowing injected `csp` with reporting.	❌	5.6 years	5.6 years
#9	Fix subsume-source-expressions algorithm	❌	4 years	4 years
#10	Should file and filesystem schemes allow blanket enforcement?	❌	4 years	4 years
#11	Cancel navigation on invalid required CSP attribute	❌	3.9 years	3.9 years
#12	Should we restrict CSPEE to secure schemes?	❌	3.9 years	3.9 years
#13	Fix examples involving wildcard host matching.	❌	3.9 years	3.9 years
#14	Wildcard hosts and CSP source intersection	❌	3.8 years	3.8 years
#15	Fix example of non-similar CSP sources with different ports	❌	3.8 years	3.8 years
#16	Meaning of 'self' in csp attribute	❌	3.8 years	3.8 years
#17	Rewrite source expression intersection without using similarity	❌	3.8 years	3.8 years
#21	Limit length of CSP attribute	❌	2.7 years	2.7 years
#24	Editor's draft not getting autoupdated	❌	2 years	2 years
#27	Broken references in Content Security Policy: Embedded Enforcement	❌	1.5 years	1.5 years