Re: CSP syntax ABNF

On 03/01/2011 03:06 PM, gaz Heyes wrote:
> On 1 March 2011 22:52, Brandon Sterne <bsterne@mozilla.com
> <mailto:bsterne@mozilla.com>> wrote:
> 
>     3. added the SecurityViolation DOM event
> 
> 
> What info is in here? :) does it apply x-domain?

The same info that is in the violation report (see below).  I made
SecurityViolation use the CustomEvent interface [1] which is nice
because it takes a generic DOMObject to describe "details".  The JSON
object that we were already building for the report body seems to work
in both cases.

As far as the cross-domain piece, I have to think: no, only the document
who has the CSP declared would receive the event, though perhaps I'm
missing something.

Cheers,
Brandon

[1]
http://dev.w3.org/2006/webapi/DOM-Level-3-Events/html/DOM3-Events.html#interface-CustomEvent

-----

3.7 Violation Report Syntax

This section defines the structure of the violation report sent by a
user-agent when a protected resource's security policy is violated.

A user-agent must send a violation report in the following two cases:

1. Whenever ANY policy violation occurs, a user-agent must dispatch a
SecurityViolation event which does not bubble and is not cancelable at
the Document object of the protected resource.

2. Whenever a policy violation occurs and the server's policy contains a
report-uri, a user-agent must send a violation report to all valid
report URIs declared in the policy via an HTTP POST request bearing the
Content-Type application/json.

The SecurityViolation DOM event and the violation report sent by a
user-agent convey the same information regarding the policy violation
and are intended to be utilized by the server for monitoring and logging.

The SecurityViolation event uses the CustomEvent interface defined in
the DOM Level 3 Events specification. [DOM-LEVEL-3-EVENTS].

The report structure defined below is a JSON object used for both the
detail argument to the SecurityViolation event constructor and the
request body of the violation report.

The SecurityViolation event detail and the report body sent by the
user-agent must be comprised of a JSON object having the following
properties:

* request: HTTP request line of the protected resource whose policy was
violated including method, URI and HTTP version
* request-headers: HTTP request headers sent with the request for the
protected resource whose policy was violated
* blocked-uri: URI of the resource that was prevented from loading due
to the policy violation
* violated-directive: The policy directive that was violated
* original-policy: The original policy as received by the user-agent.

If the policy was received via more than one Content Security Policy
response header, this field must contain a comma separated list of
original policies.

In the case where a protected resource is not rendered because its
frame-ancestors directive is violated, user-agents must not send
blocked-uri in the report as it is assumed to have the same value as
request.

Received on Tuesday, 1 March 2011 23:53:44 UTC