W3C home > Mailing lists > Public > public-web-security@w3.org > June 2011

Re: script-src requirements

From: Brandon Sterne <bsterne@mozilla.com>
Date: Tue, 07 Jun 2011 17:13:06 -0700
Message-ID: <4DEEBE92.6090402@mozilla.com>
To: Adam Barth <w3c@adambarth.com>
CC: public-web-security@w3.org
On 03/28/2011 01:24 PM, Brandon Sterne wrote:
> On 03/27/2011 04:48 PM, Adam Barth wrote:
>> IMHO, we should phrase the resource-loading requirements for CSP in
>> terms of HTML5's "fetch" apparatus:
>>
>> http://www.whatwg.org/specs/web-apps/current-work/#fetching-resources
>>
>> For example, that's how CORS specifies how to handle cross-origin
>> XMLHttpRequests:
>>
>> http://www.w3.org/TR/access-control/
> 
> This is a good suggestion.  I've created a TODO item in my personal
> issue tracker and should be able to address this in the next week or so.

Well, that turned out to be significantly more than a "week or so", but
I completed this change nevertheless:

https://dvcs.w3.org/hg/content-security-policy/rev/4ccc87cc3a37
https://dvcs.w3.org/hg/content-security-policy/rev/190ae9b27a24

I hope the new verbiage is clearer.  Let me know if it's not.

Best,
Brandon
Received on Wednesday, 8 June 2011 00:13:21 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:26:19 UTC