Weekly github digest (WebAppSec specs)

Issues
------
* w3c/webappsec-csp (+1/-6/💬41)
  1 issues created:
  - Sandbox directive for workers (by aliams)
    https://github.com/w3c/webappsec-csp/issues/279

  14 issues received 41 new comments:
  - #107 Specify behavior of prefetch requests (9 by april, mikewest, yoavweiss, ri0t, michaelficarra)
    https://github.com/w3c/webappsec-csp/issues/107
  - #278 Allow report-uri in meta tags. (9 by ScottHelme, annevk, mikewest, andypaicu)
    https://github.com/w3c/webappsec-csp/issues/278
  - #277 Allow CSP-Report-Only in meta tags. (5 by ScottHelme, mikewest, andypaicu, dhausknecht)
    https://github.com/w3c/webappsec-csp/issues/277
  - #98 Prevent nonce stealing by looking for "<script" in attributes of nonced scripts (3 by andypaicu, erfe1)
    https://github.com/w3c/webappsec-csp/issues/98
  - #109 Hash encodings should be converted to UTF-8 (3 by annevk, andypaicu)
    https://github.com/w3c/webappsec-csp/issues/109
  - #65 Consider not exposing nonce="" to the page (2 by andypaicu, mikewest)
    https://github.com/w3c/webappsec-csp/issues/65
  - #100 Permit blocking of certain hosts (2 by andypaicu, yoavweiss)
    https://github.com/w3c/webappsec-csp/issues/100
  - #26 block-all-mixed-content for report-only (2 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/26
  - #86 CSP Violation Reports for redirects should include full original URI and origins in the redirect URIs (1 by andypaicu)
    https://github.com/w3c/webappsec-csp/issues/86
  - #258 Add note about the importance of preventing nonce exfiltration/reuse (1 by andypaicu)
    https://github.com/w3c/webappsec-csp/issues/258
  - #279 Sandbox directive for workers (1 by annevk)
    https://github.com/w3c/webappsec-csp/issues/279
  - #186 Add <base target="x" /> to CSP (1 by andypaicu)
    https://github.com/w3c/webappsec-csp/issues/186
  - #91 Consider providing a way to tighten source-expressions that contain `self` (1 by andypaicu)
    https://github.com/w3c/webappsec-csp/issues/91
  - #255 Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/255

  6 issues closed:
  - Add <base target="x" /> to CSP https://github.com/w3c/webappsec-csp/issues/186
  - Permit blocking of certain hosts https://github.com/w3c/webappsec-csp/issues/100
  - Prevent nonce stealing by looking for "<script" in attributes of nonced scripts https://github.com/w3c/webappsec-csp/issues/98
  - CSP Violation Reports for redirects should include full original URI and origins in the redirect URIs https://github.com/w3c/webappsec-csp/issues/86
  - Allow report-uri in meta tags. https://github.com/w3c/webappsec-csp/issues/278
  - Consider not exposing nonce="" to the page https://github.com/w3c/webappsec-csp/issues/65

* w3c/permissions (+0/-0/💬5)
  1 issues received 5 new comments:
  - #165 A new permission for canvas data (5 by tomrittervg, tabatkins, KOLANICH)
    https://github.com/w3c/permissions/issues/165

* w3c/webappsec-secure-contexts (+0/-1/💬1)
  1 issues received 1 new comments:
  - #53 Error msg (https://goo.gl/Y0ZkNV)  instead of giving the latitude and longitude (1 by annevk)
    https://github.com/w3c/webappsec-secure-contexts/issues/53

  1 issues closed:
  - Error msg (https://goo.gl/Y0ZkNV)  instead of giving the latitude and longitude https://github.com/w3c/webappsec-secure-contexts/issues/53

* w3c/webappsec-clear-site-data (+0/-1/💬1)
  1 issues received 1 new comments:
  - #39 Regenerate https://www.w3.org/TR/clear-site-data/ (1 by msramek)
    https://github.com/w3c/webappsec-clear-site-data/issues/39

  1 issues closed:
  - Regenerate https://www.w3.org/TR/clear-site-data/ https://github.com/w3c/webappsec-clear-site-data/issues/39



Pull requests
-------------
* w3c/webappsec-clear-site-data (+2/-3/💬2)
  2 pull requests submitted:
  - Migrated the performance demo to appengine. (by msramek)
    https://github.com/w3c/webappsec-clear-site-data/pull/47
  - Added data type selection. (by msramek)
    https://github.com/w3c/webappsec-clear-site-data/pull/46

  1 pull requests received 2 new comments:
  - #41 Fix typos (2 by mikewest)
    https://github.com/w3c/webappsec-clear-site-data/pull/41

  3 pull requests merged:
  - Fix typos
    https://github.com/w3c/webappsec-clear-site-data/pull/41
  - Migrated the performance demo to appengine.
    https://github.com/w3c/webappsec-clear-site-data/pull/47
  - Added data type selection.
    https://github.com/w3c/webappsec-clear-site-data/pull/46


Repositories tracked by this digest:
-----------------------------------
* https://github.com/w3c/webappsec
* https://github.com/w3c/webappsec-subresource-integrity
* https://github.com/w3c/webappsec-csp
* https://github.com/w3c/webappsec-mixed-content
* https://github.com/w3c/webappsec-upgrade-insecure-requests
* https://github.com/w3c/webappsec-credential-management
* https://github.com/w3c/permissions
* https://github.com/w3c/webappsec-referrer-policy
* https://github.com/w3c/webappsec-secure-contexts
* https://github.com/w3c/webappsec-clear-site-data
* https://github.com/w3c/webappsec-cowl
* https://github.com/w3c/webappsec-epr
* https://github.com/w3c/webappsec-suborigins