Web Application Security Working Group - Activity in 2017
No matches.
Participants
-
1 organization joined.
-
Bocoup joined.
-
GitHub
w3c/webappsec-csp
-
5 issues opened.
-
Allow report-uri in meta tags. w3c/webappsec-csp#278, by @ScottHelme.
-
Allow CSP-Report-Only in meta tags. w3c/webappsec-csp#277, by @ScottHelme.
-
WPT tests tracker w3c/webappsec-csp#276, by @andypaicu.
-
Wrap up CSP 3, Move to CSP 4 w3c/webappsec-csp#275, by @shhnjk.
-
CSP Directives Should Be Structured w3c/webappsec-csp#274, by @David263.
-
-
4 issues closed.
-
SecurityPolicyViolationEvent's sourceFile seems wrong w3c/webappsec-csp#267.
-
The “report a violation” algorithm assumes report-uri contains a single URL? w3c/webappsec-csp#270.
-
What does it mean to alias a policy from a CSP list? w3c/webappsec-csp#207.
-
8 issues received 15 new comments.
-
CSP3: Consider adding a 'no-console-log' directive w3c/webappsec-csp#217 (5 comments by @april, @devd, @ScottHelme, @Zirro)
-
Embedded: make clear that servers MUST respond with a CSP or Allow-CSP-From header, <meta> CSP's are not allowed. w3c/webappsec-csp#225 (2 comments by @annevk, @David263)
-
What does it mean to alias a policy from a CSP list? w3c/webappsec-csp#207 (1 comment by @andypaicu)
-
-
3 pull requests merged.
-
IDL amendments and small misc issues. w3c/webappsec-csp#271.
-
link up inline css issue w3c/webappsec-csp#228.
-
Replaced 'alias' with 'copy' for less ambiguity w3c/webappsec-csp#273.
-
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Error msg (https://goo.gl/Y0ZkNV) instead of giving the latitude and longitude w3c/webappsec-secure-contexts#53, by @JTurcott.
-
w3c/permissions
-
1 issue opened.
-
A new permission for canvas data w3c/permissions#165, by @tomrittervg.
-
-
1 issue received 16 new comments.
-
A new permission for canvas data w3c/permissions#165 (16 comments by @annevk, @isislovecruft, @jyasskin, @KOLANICH, @pento, @raymeskhoury, @tomrittervg)
-
-
1 pull request opened.
-
Discuss how query() makes abuse harder to detect. w3c/permissions#166, by @jyasskin.
-
-
1 pull request merged.
-
Introduce "Automation" section w3c/permissions#151.
-
-
2 pull requests received 20 new comments.
-
Introduce "Automation" section w3c/permissions#151 (18 comments by @AutomatedTester, @jugglinmike, @jyasskin, @kereliuk, @mounirlamouri)
-
Discuss how query() makes abuse harder to detect. w3c/permissions#166 (2 comments by @jyasskin, @npdoty)
-
w3c/webappsec-permissions-policy
-
15 issues opened.
-
typo: "whietlist" w3c/webappsec-permissions-policy#116, by @thiemonagel.
-
"ASCII serialization" w3c/webappsec-permissions-policy#115, by @annevk.
-
aware/oblivious w3c/webappsec-permissions-policy#114, by @annevk.
-
Wrong origin w3c/webappsec-permissions-policy#113, by @annevk.
-
URL parser w3c/webappsec-permissions-policy#112, by @annevk.
-
Nonstandard [Reflect] extended attribute w3c/webappsec-permissions-policy#110, by @annevk.
-
ASCII serialization: origin serialization w3c/webappsec-permissions-policy#109, by @annevk.
-
Link top of https://github.com/WICG/feature-policy to spec w3c/webappsec-permissions-policy#108, by @annevk.
-
allowlist same-origin domain w3c/webappsec-permissions-policy#107, by @annevk.
-
allowlist matches w3c/webappsec-permissions-policy#106, by @annevk.
-
allowlist type w3c/webappsec-permissions-policy#105, by @annevk.
-
"allowlist" w3c/webappsec-permissions-policy#103, by @annevk.
-
Concerns around syntax w3c/webappsec-permissions-policy#100, by @annevk.
-
Header field and parser out of sync? w3c/webappsec-permissions-policy#99, by @annevk.
-
-
8 issues closed.
-
URL parser w3c/webappsec-permissions-policy#112.
-
ASCII serialization: origin serialization w3c/webappsec-permissions-policy#109.
-
commas w3c/webappsec-permissions-policy#111.
-
typo: "whietlist" w3c/webappsec-permissions-policy#116.
-
Nonstandard [Reflect] extended attribute w3c/webappsec-permissions-policy#110.
-
Wrong origin w3c/webappsec-permissions-policy#113.
-
Link top of https://github.com/WICG/feature-policy to spec w3c/webappsec-permissions-policy#108.
-
Clarify integration with HTML w3c/webappsec-permissions-policy#95.
-
-
13 issues received 34 new comments.
-
"allowlist" w3c/webappsec-permissions-policy#103 (6 comments by @annevk, @clelland, @jyasskin, @raymeskhoury)
-
allowlist same-origin domain w3c/webappsec-permissions-policy#107 (3 comments by @annevk, @clelland, @mikewest)
-
Concerns around syntax w3c/webappsec-permissions-policy#100 (3 comments by @annevk, @clelland, @domenic)
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (2 comments by @annevk, @ojanvafai)
-
Header field and parser out of sync? w3c/webappsec-permissions-policy#99 (2 comments by @annevk, @clelland)
-
Link top of https://github.com/WICG/feature-policy to spec w3c/webappsec-permissions-policy#108 (1 comment by @clelland)
-
-
10 pull requests opened.
-
Update description and definition of allowlist. w3c/webappsec-permissions-policy#123, by @clelland.
-
Reference "URL parser" from the URL spec w3c/webappsec-permissions-policy#122, by @clelland.
-
Refer to HTML definition of origin serialization. w3c/webappsec-permissions-policy#121, by @clelland.
-
Refer to code points consistently. w3c/webappsec-permissions-policy#120, by @clelland.
-
Remove non-standard "Reflect" from IDL w3c/webappsec-permissions-policy#118, by @clelland.
-
Link to HTML definition of origin rather than URL w3c/webappsec-permissions-policy#117, by @clelland.
-
Update html integration w3c/webappsec-permissions-policy#104, by @clelland.
-
Sensor policy-controlled features definition w3c/webappsec-permissions-policy#102, by @pozdnyakov.
-
Add picture-in-picture to features w3c/webappsec-permissions-policy#101, by @beaufortfrancois.
-
-
9 pull requests merged.
-
Reference "URL parser" from the URL spec w3c/webappsec-permissions-policy#122.
-
Refer to HTML definition of origin serialization. w3c/webappsec-permissions-policy#121.
-
Refer to code points consistently. w3c/webappsec-permissions-policy#120.
-
Fix typo w3c/webappsec-permissions-policy#119.
-
Remove non-standard "Reflect" from IDL w3c/webappsec-permissions-policy#118.
-
Link to HTML definition of origin rather than URL w3c/webappsec-permissions-policy#117.
-
Update html integration w3c/webappsec-permissions-policy#104.
-
Sensor policy-controlled features definition w3c/webappsec-permissions-policy#102.
-
Add picture-in-picture to features w3c/webappsec-permissions-policy#101.
-
-
2 pull requests received 5 new comments.
-
Sensor policy-controlled features definition w3c/webappsec-permissions-policy#102 (3 comments by @anssiko, @raymeskhoury)
-
Add picture-in-picture to features w3c/webappsec-permissions-policy#101 (2 comments by @clelland, @mounirlamouri)
-
w3c/webcrypto
-
1 issue opened.
-
Problems with ECDH deriveBits/deriveKey operations w3c/webcrypto#193, by @NeilMadden.
-
-
1 issue received 1 new comment.
-
window.crypto.subtle.importKey not working for me when i hosted my web app on Server (IIS or NodeJs) w3c/webcrypto#192 (1 comment by @LiraNuna)
-
-
1 pull request opened.
-
Use Web IDL's new-ish interface mixins concept w3c/webcrypto#194, by @romandev.
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (1 comment by @EGreg)
-
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Performance demo added. w3c/webappsec-clear-site-data#45, by @msramek.
-
-
1 pull request merged.
-
Performance demo added. w3c/webappsec-clear-site-data#45.
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
4 issues opened.
-
Expose information on status of TrustedTypes enforcement w3c/trusted-types#36, by @xtofian.
-
TrustedHTML.unwrap vs TrustedHTML.prototype.toString w3c/trusted-types#35, by @xtofian.
-
Explore granular enforcement of types w3c/trusted-types#33, by @koto.
-
Support application-specific sanitizers / type builders w3c/trusted-types#32, by @koto.
-
-
7 issues received 25 new comments.
-
Consider surfacing sanitization fallbacks to the developer w3c/trusted-types#21 (8 comments by @koto, @xtofian)
-
Mechanism to constrain usages of unsafelyCreate w3c/trusted-types#31 (3 comments by @koto, @xtofian)
-
TrustedHTML.unwrap vs TrustedHTML.prototype.toString w3c/trusted-types#35 (2 comments by @koto, @xtofian)
-
Support application-specific sanitizers / type builders w3c/trusted-types#32 (1 comment by @xtofian)
-
-
1 pull request opened.
-
Greenkeeper/initial w3c/trusted-types#34, by @Kukkik42.
-
-
1 pull request closed.
-
Greenkeeper/initial w3c/trusted-types#34.
-
w3c/webappsec-credential-management
-
1 issue received 1 new comment.
-
"sameOriginWithAncestors is unused" ? should s/unused/false/ ? w3c/webappsec-credential-management#116 (1 comment by @mikewest)
-
-
1 pull request opened.
-
JS syntax fixes w3c/webappsec-credential-management#117, by @jakearchibald.
-
-
1 pull request merged.
-
JS syntax fixes w3c/webappsec-credential-management#117.
-
-
1 pull request received 2 new comments.
TR publications
-
1 document published.
-
Clear Site Data published as a Working Draft. History of Clear Site Data
-
GitHub
w3c/trusted-types
-
2 issues opened.
-
Mechanism to constrain usages of unsafelyCreate w3c/trusted-types#31, by @xtofian.
-
"Trusted types" and "Literals in script" w3c/trusted-types#30, by @craigfrancis.
-
w3c/webappsec-csp
-
10 issues opened.
-
missing local / network scheme definition in URL spec w3c/webappsec-csp#272, by @dhausknecht.
-
The “report a violation” algorithm assumes report-uri contains a single URL? w3c/webappsec-csp#270, by @sideshowbarker.
-
Enable call stack for blocked_uri in Content Security Policy Reporting w3c/webappsec-csp#269, by @vibhasethi.
-
Line and column number types w3c/webappsec-csp#268, by @annevk.
-
SecurityPolicyViolationEvent's sourceFile seems wrong w3c/webappsec-csp#267, by @annevk.
-
SecurityPolicyViolationEvent needs more USVString w3c/webappsec-csp#266, by @annevk.
-
Don't use `not-example.com` in examples. w3c/webappsec-csp#264, by @tomprince.
-
Please clearly mark older versions as obsolete w3c/webappsec-csp#262, by @annevk.
-
Relax CSP source path matching when response is replaced by service worker e.g. redirects w3c/webappsec-csp#261, by @aliams.
-
-
2 issues closed.
-
missing local / network scheme definition in URL spec w3c/webappsec-csp#272.
-
Don't use `not-example.com` in examples. w3c/webappsec-csp#264.
-
-
14 issues received 37 new comments.
-
What does it mean to alias a policy from a CSP list? w3c/webappsec-csp#207 (6 comments by @andypaicu, @bzbarsky, @ckerschb, @mikewest)
-
missing local / network scheme definition in URL spec w3c/webappsec-csp#272 (5 comments by @annevk, @dhausknecht)
-
Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. w3c/webappsec-csp#255 (5 comments by @ckerschb, @dveditz, @ScottHelme, @SkateScout, @Zirro)
-
Any protection against dynamic module import? w3c/webappsec-csp#243 (4 comments by @arturjanc, @devd)
-
SecurityPolicyViolationEventInit doesn't have default values for the properties, nor has marked them required w3c/webappsec-csp#265 (3 comments by @annevk, @mikewest, @smaug----)
-
SecurityPolicyViolationEvent needs more USVString w3c/webappsec-csp#266 (2 comments by @annevk, @domenic)
-
Is inheritance of 'self' to local-scheme appropriate? w3c/webappsec-csp#259 (2 comments by @annevk, @ckerschb)
-
Enable call stack for blocked_uri in Content Security Policy Reporting w3c/webappsec-csp#269 (1 comment by @prbinu)
-
Handling of 'self' is unclear when inheriting CSP to local scheme w3c/webappsec-csp#248 (1 comment by @ckerschb)
-
Relax CSP source path matching when response is replaced by service worker e.g. redirects w3c/webappsec-csp#261 (1 comment by @annevk)
-
-
3 pull requests opened.
-
Replaced 'alias' with 'copy' for less ambiguity w3c/webappsec-csp#273, by @andypaicu.
-
IDL amendments and small misc issues. w3c/webappsec-csp#271, by @andypaicu.
-
Linked testing policy and fixed a few links w3c/webappsec-csp#263, by @plehegar.
-
-
2 pull requests merged.
-
Cleanup `global object` usage to make sense with `Documents` w3c/webappsec-csp#254.
-
Linked testing policy and fixed a few links w3c/webappsec-csp#263.
-
-
3 pull requests received 32 new comments.
-
IDL amendments and small misc issues. w3c/webappsec-csp#271 (21 comments by @andypaicu, @annevk, @mikewest, @Zirro)
-
Replaced 'alias' with 'copy' for less ambiguity w3c/webappsec-csp#273 (10 comments by @andypaicu, @bzbarsky, @mikewest)
-
Cleanup `global object` usage to make sense with `Documents` w3c/webappsec-csp#254 (1 comment by @andypaicu)
-
w3c/webappsec-clear-site-data
-
4 issues received 15 new comments.
-
Can't clear site data while offline w3c/webappsec-clear-site-data#40 (8 comments by @annevk, @Krinkle, @mikewest, @msramek)
-
Is registerProtocolHandler() affected? w3c/webappsec-clear-site-data#37 (4 comments by @annevk, @msramek)
-
-
3 pull requests opened.
-
Added a cache performance warning. w3c/webappsec-clear-site-data#44, by @msramek.
-
Add the wildcard pseudotype. w3c/webappsec-clear-site-data#43, by @msramek.
-
Linked testing policy and fixed a few links w3c/webappsec-clear-site-data#42, by @plehegar.
-
-
3 pull requests merged.
-
Added a cache performance warning. w3c/webappsec-clear-site-data#44.
-
Add the wildcard pseudotype. w3c/webappsec-clear-site-data#43.
-
Linked testing policy and fixed a few links w3c/webappsec-clear-site-data#42.
-
-
1 pull request received 1 new comment.
w3c/webappsec-cowl
-
1 issue opened.
-
Giving Abdul push access to repo w3c/webappsec-cowl#79, by @deian.
-
-
6 issues closed.
-
Giving Abdul push access to repo w3c/webappsec-cowl#79.
-
example 23 is uggy w3c/webappsec-cowl#73.
-
Restrict COWL to secure contexts w3c/webappsec-cowl#43.
-
Extend for Server-Sent Events w3c/webappsec-cowl#64.
-
Specify how COWL deals with WebRTC w3c/webappsec-cowl#65.
-
Specify same-origin IPC vs. shared memory edgecase w3c/webappsec-cowl#47.
-
-
7 issues received 12 new comments.
-
4 pull requests opened.
-
Fix build errors w3c/webappsec-cowl#78, by @ak-14.
-
Fix example 23 missing parens w3c/webappsec-cowl#77, by @ak-14.
-
Linked testing policy and fixed a few links w3c/webappsec-cowl#76, by @plehegar.
-
Update sandboxing flags section w3c/webappsec-cowl#75, by @ak-14.
-
-
4 pull requests merged.
-
Fix build errors w3c/webappsec-cowl#78.
-
Fix example 23 missing parens w3c/webappsec-cowl#77.
-
Update sandboxing flags section w3c/webappsec-cowl#75.
-
Linked testing policy and fixed a few links w3c/webappsec-cowl#76.
-
-
1 pull request received 2 new comments.
w3c/permissions
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/permissions#164, by @plehegar.
-
-
1 pull request merged.
-
Linked testing policy and fixed a few links w3c/permissions#164.
-
-
1 pull request received 11 new comments.
-
Introduce "Automation" section w3c/permissions#151 (11 comments by @andreastt, @foolip, @kereliuk, @marcoscaceres, @shs96c)
-
w3c/webappsec-permissions-policy
-
5 issues opened.
-
Media w3c/webappsec-permissions-policy#98, by @bonebizz21.
-
Modification of allowlist at runtime w3c/webappsec-permissions-policy#97, by @alexshalamov.
-
Provide opt-out option to disable HTTP basic-auth on a webpage w3c/webappsec-permissions-policy#96, by @prbinu.
-
Clarify integration with HTML w3c/webappsec-permissions-policy#95, by @clelland.
-
Require SecurityError to be used for EME w3c/webappsec-permissions-policy#92, by @foolip.
-
-
4 issues closed.
-
Media w3c/webappsec-permissions-policy#98.
-
Require SecurityError to be used for EME w3c/webappsec-permissions-policy#92.
-
Address addition of new features w3c/webappsec-permissions-policy#44.
-
Modification of allowlist at runtime w3c/webappsec-permissions-policy#97.
-
-
9 issues received 19 new comments.
-
Require SecurityError to be used for EME w3c/webappsec-permissions-policy#92 (6 comments by @clelland, @foolip, @raymeskhoury)
-
Modification of allowlist at runtime w3c/webappsec-permissions-policy#97 (4 comments by @alexshalamov, @andrey-logvinov, @clelland)
-
Clarify integration with HTML w3c/webappsec-permissions-policy#95 (3 comments by @annevk, @clelland)
-
Provide opt-out option to disable HTTP basic-auth on a webpage w3c/webappsec-permissions-policy#96 (1 comment by @clelland)
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (1 comment by @annevk)
-
Specify handling of IDN / Unicode chars in origins w3c/webappsec-permissions-policy#51 (1 comment by @annevk)
-
[TAG] New Registry; Strategy for Updates? w3c/webappsec-permissions-policy#75 (1 comment by @annevk)
-
-
1 pull request opened.
-
Update parsing algorithms. w3c/webappsec-permissions-policy#94, by @clelland.
-
-
2 pull requests merged.
-
Don't claim that the spec defines feature names w3c/webappsec-permissions-policy#88.
-
Update parsing algorithms. w3c/webappsec-permissions-policy#94.
-
-
1 pull request received 2 new comments.
w3c/webappsec-credential-management
-
4 issues opened.
-
"sameOriginWithAncestors is unused" ? should s/unused/false/ ? w3c/webappsec-credential-management#116, by @equalsJeffH.
-
current build error and linking warnings w3c/webappsec-credential-management#115, by @equalsJeffH.
-
allow credential-type specs to declare top-level-only or not w3c/webappsec-credential-management#113, by @equalsJeffH.
-
Update WebIDL definition(s) to use new mixin syntax w3c/webappsec-credential-management#111, by @tobie.
-
-
1 issue closed.
-
[[Store]] implementations should be able to fail. w3c/webappsec-credential-management#107.
-
-
5 issues received 9 new comments.
-
Spec is unclear on what the promise returned by store() is resolved with (Credential/undefined) w3c/webappsec-credential-management#98 (5 comments by @battre, @billiegoose, @mikewest)
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec-credential-management#3 (1 comment by @equalsJeffH)
-
"sameOriginWithAncestors is unused" ? should s/unused/false/ ? w3c/webappsec-credential-management#116 (1 comment by @equalsJeffH)
-
current build error and linking warnings w3c/webappsec-credential-management#115 (1 comment by @equalsJeffH)
-
Update WebIDL definition(s) to use new mixin syntax w3c/webappsec-credential-management#111 (1 comment by @mikewest)
-
-
3 pull requests opened.
-
Remove the blanket restriction against nested usage. w3c/webappsec-credential-management#114, by @mikewest.
-
Linked testing policy and fixed a few links w3c/webappsec-credential-management#112, by @plehegar.
-
Handle the AbortSignal in get() and create() themselves. w3c/webappsec-credential-management#110, by @jyasskin.
-
-
4 pull requests merged.
-
Remove the blanket restriction against nested usage. w3c/webappsec-credential-management#114.
-
Linked testing policy and fixed a few links w3c/webappsec-credential-management#112.
-
[[Store]] can fail. w3c/webappsec-credential-management#108.
-
Handle the AbortSignal in get() and create() themselves. w3c/webappsec-credential-management#110.
-
-
1 pull request closed.
-
Added aborted flag to the Create and DiscoverFromExternalSource methods w3c/webappsec-credential-management#104.
-
-
5 pull requests received 37 new comments.
-
Remove the blanket restriction against nested usage. w3c/webappsec-credential-management#114 (17 comments by @battre, @equalsJeffH, @mikewest)
-
Added aborted flag to the Create and DiscoverFromExternalSource methods w3c/webappsec-credential-management#104 (13 comments by @AngeloKai, @jcjones, @jyasskin)
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (3 comments by @equalsJeffH, @mikewest)
-
Handle the AbortSignal in get() and create() themselves. w3c/webappsec-credential-management#110 (3 comments by @jyasskin, @mikewest)
-
w3c/webappsec-referrer-policy
-
4 issues opened.
-
add back "none" as legacy keyword w3c/webappsec-referrer-policy#112, by @jeisinger.
-
Should JavaScript module imports respect referrer policy, and if so, how? w3c/webappsec-referrer-policy#111, by @domenic.
-
Referrer policy of child css? w3c/webappsec-referrer-policy#109, by @tungnh28.
-
Referrer policy of referencing in SVG? w3c/webappsec-referrer-policy#108, by @tungnh28.
-
-
6 issues closed.
-
Referrer policy of child css? w3c/webappsec-referrer-policy#109.
-
`ping-from`? w3c/webappsec-referrer-policy#70.
-
Examples table w3c/webappsec-referrer-policy#54.
-
Please clarify if header value should be enclosed in quotes or not w3c/webappsec-referrer-policy#97.
-
Use concept-request in algorithms w3c/webappsec-referrer-policy#39.
-
8.4 Minor wording inconsistency w3c/webappsec-referrer-policy#106.
-
-
7 issues received 16 new comments.
-
Referrer policy of referencing in SVG? w3c/webappsec-referrer-policy#108 (7 comments by @annevk, @dbaron, @jeisinger, @tungnh28)
-
Referrer policy of child css? w3c/webappsec-referrer-policy#109 (3 comments by @jeisinger, @tungnh28)
-
"TLS-protected" link seems not very useful w3c/webappsec-referrer-policy#82 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/webappsec-referrer-policy#110, by @plehegar.
-
-
2 pull requests merged.
-
Linked testing policy and fixed a few links w3c/webappsec-referrer-policy#110.
-
Fix HTML link: creation URL w3c/webappsec-referrer-policy#107.
-
-
1 pull request received 1 new comment.
-
Linked testing policy and fixed a few links w3c/webappsec-referrer-policy#110 (1 comment by @mikewest)
-
w3c/webappsec-upgrade-insecure-requests
-
3 issues opened.
-
"a priori authenticated" w3c/webappsec-upgrade-insecure-requests#13, by @annevk.
-
Cross-origin navigation w3c/webappsec-upgrade-insecure-requests#12, by @annevk.
-
Upstream WebSocket bits to Fetch w3c/webappsec-upgrade-insecure-requests#11, by @annevk.
-
-
1 issue closed.
-
Cross-origin navigation w3c/webappsec-upgrade-insecure-requests#12.
-
-
1 issue received 6 new comments.
-
Cross-origin navigation w3c/webappsec-upgrade-insecure-requests#12 (6 comments by @annevk, @mikewest)
-
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/webappsec-upgrade-insecure-requests#10, by @plehegar.
-
-
1 pull request merged.
-
Linked testing policy and fixed a few links w3c/webappsec-upgrade-insecure-requests#10.
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
What about RDF ? w3c/webappsec-subresource-integrity#76, by @akuckartz.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/webappsec-subresource-integrity#75, by @plehegar.
-
-
1 pull request merged.
-
Linked testing policy and fixed a few links w3c/webappsec-subresource-integrity#75.
-
w3c/webappsec
-
1 issue opened.
-
Restricting JavaScript from accessing secrets w3c/webappsec#536, by @craigfrancis.
-
-
1 issue received 2 new comments.
-
Restricting JavaScript from accessing secrets w3c/webappsec#536 (2 comments by @craigfrancis, @mikewest)
-
-
1 pull request opened.
-
Added testing policy and fixed a few links w3c/webappsec#535, by @plehegar.
-
-
1 pull request merged.
-
Added testing policy and fixed a few links w3c/webappsec#535.
-
w3c/webcrypto
-
3 issues opened.
-
Update WebIDL definition(s) to use new mixin syntax w3c/webcrypto#191, by @tobie.
-
privateKeyInfo structure reference w3c/webcrypto#190, by @wh0.
-
1 issue received 1 new comment.
w3c/webappsec-uisecurity
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/webappsec-uisecurity#12, by @plehegar.
-
-
1 pull request merged.
-
Linked testing policy and fixed a few links w3c/webappsec-uisecurity#12.
-
w3c/webappsec-mixed-content
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/webappsec-mixed-content#14, by @plehegar.
-
-
1 pull request merged.
-
Linked testing policy and fixed a few links w3c/webappsec-mixed-content#14.
-
w3c/webappsec-secure-contexts
-
1 issue closed.
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26.
-
-
3 issues received 3 new comments.
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28 (1 comment by @bzbarsky)
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42 (1 comment by @bzbarsky)
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Linked testing policy and fixed a few links w3c/webappsec-secure-contexts#52, by @plehegar.
-
-
1 pull request merged.
-
Linked testing policy and fixed a few links w3c/webappsec-secure-contexts#52.
-
w3c/webappsec-cors-for-developers
-
1 pull request closed.
-
two minor nits w3c/webappsec-cors-for-developers#7.
-
w3c/webappsec-suborigins
-
1 issue opened.
-
Tainting a canvas in case of different suborigins w3c/webappsec-suborigins#79, by @mniemietz.
-
-
1 issue received 2 new comments.
-
Tainting a canvas in case of different suborigins w3c/webappsec-suborigins#79 (2 comments by @annevk, @mniemietz)
-
Participants
-
1 participant joined.
-
Abdulrahman Alkhelaifi (W3C Invited Experts) joined.
-
-
2 organizations joined.
-
SEEROO Information Co., Ltd joined.
-
Akamai Technologies joined.
-
GitHub
w3c/webappsec-credential-management
-
4 issues opened.
-
Editorial cleanups in section "2.3 navigator.credentials" w3c/webappsec-credential-management#109, by @equalsJeffH.
-
[[Store]] implementations should be able to fail. w3c/webappsec-credential-management#107, by @jyasskin.
-
origins are just "serialized" w3c/webappsec-credential-management#106, by @equalsJeffH.
-
add [=in parallel=] to credential internal methods w3c/webappsec-credential-management#105, by @equalsJeffH.
-
-
2 issues received 5 new comments.
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec-credential-management#3 (4 comments by @battre, @jcjones, @mikewest)
-
[[Store]] implementations should be able to fail. w3c/webappsec-credential-management#107 (1 comment by @domenic)
-
-
1 pull request opened.
-
[[Store]] can fail. w3c/webappsec-credential-management#108, by @mikewest.
-
-
3 pull requests received 79 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (74 comments by @equalsJeffH, @jyasskin, @mikewest)
-
Added aborted flag to the Create and DiscoverFromExternalSource methods w3c/webappsec-credential-management#104 (4 comments by @AngeloKai, @equalsJeffH, @jyasskin)
-
w3c/webappsec-csp
-
10 issues opened.
-
What is the 'self' of sandboxed page? w3c/webappsec-csp#260, by @shhnjk.
-
Is inheritance of 'self' to local-scheme appropriate? w3c/webappsec-csp#259, by @shhnjk.
-
Add note about the importance of preventing nonce exfiltration/reuse w3c/webappsec-csp#258, by @arturjanc.
-
Incorrect form-action pre-navigation check text? w3c/webappsec-csp#257, by @christhompson.
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256, by @AndrewStoyan.
-
Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. w3c/webappsec-csp#255, by @ScottHelme.
-
Obsolete https://w3c.github.io/webappsec-csp/api/? w3c/webappsec-csp#253, by @foolip.
-
What I am doing wrong on this script-src w3c/webappsec-csp#252, by @petrospap.
-
Optional path-abempty part makes no sense w3c/webappsec-csp#249, by @notriddle.
-
Handling of 'self' is unclear when inheriting CSP to local scheme w3c/webappsec-csp#248, by @shhnjk.
-
-
5 issues closed.
-
Unable to parse IPv6 addresses in CSP source list w3c/webappsec-csp#224.
-
Spec incorrectly states *.example.com “matches any resource on the host”? w3c/webappsec-csp#241.
-
Integration with worklets w3c/webappsec-csp#204.
-
Optional path-abempty part makes no sense w3c/webappsec-csp#249.
-
CSP3: Note that the `disown-opener` directive needs to be sent in the HTTP headers w3c/webappsec-csp#193.
-
-
18 issues received 42 new comments.
-
Handling of 'self' is unclear when inheriting CSP to local scheme w3c/webappsec-csp#248 (7 comments by @andypaicu, @annevk, @dveditz, @shhnjk)
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256 (5 comments by @AndrewStoyan, @michaelficarra, @mozfreddyb)
-
Remove worker references from child-src section w3c/webappsec-csp#239 (5 comments by @andypaicu, @ckerschb, @mikewest)
-
Should securitypolicyviolation have element set in more cases w3c/webappsec-csp#242 (4 comments by @andypaicu, @annevk)
-
Prevent CSP reports being sent if I handle the SecurityPolicyViolation event. w3c/webappsec-csp#255 (2 comments by @mikewest)
-
Obsolete https://w3c.github.io/webappsec-csp/api/? w3c/webappsec-csp#253 (2 comments by @annevk, @mikewest)
-
What does it mean to alias a policy from a CSP list? w3c/webappsec-csp#207 (2 comments by @andypaicu, @bzbarsky)
-
Optional path-abempty part makes no sense w3c/webappsec-csp#249 (2 comments by @andypaicu, @mikewest)
-
Spec incorrectly states *.example.com “matches any resource on the host”? w3c/webappsec-csp#241 (1 comment by @andypaicu)
-
Case-sensitivity resulting in divergent browser behavior w3c/webappsec-csp#236 (1 comment by @andypaicu)
-
CSP3: Note that the `disown-opener` directive needs to be sent in the HTTP headers w3c/webappsec-csp#193 (1 comment by @andypaicu)
-
The `disown-opener` directive is not the right model w3c/webappsec-csp#194 (1 comment by @andypaicu)
-
-
5 pull requests opened.
-
Cleanup `global object` usage to make sense with `Documents` w3c/webappsec-csp#254, by @andypaicu.
-
Slight correction of `host-matching` description w3c/webappsec-csp#251, by @andypaicu.
-
Fixed ambigous grammar around `path-part` w3c/webappsec-csp#250, by @andypaicu.
-
Add extra note for 'unsafe-hashed-attributes' to address backwards co… w3c/webappsec-csp#247, by @andypaicu.
-
Add extra note for 'unsafe-inline-attributes' to address backwards co… w3c/webappsec-csp#246, by @andypaicu.
-
-
4 pull requests merged.
-
Adds WorkletGlobalScope as a concept to CSP. w3c/webappsec-csp#205.
-
Slight correction of `host-matching` description w3c/webappsec-csp#251.
-
Fixed ambigous grammar around `path-part` w3c/webappsec-csp#250.
-
Replace Request.type based logic with Request.destination w3c/webappsec-csp#231.
-
-
1 pull request closed.
-
Add extra note for 'unsafe-inline-attributes' to address backwards co… w3c/webappsec-csp#246.
-
-
5 pull requests received 16 new comments.
-
Add extra note for 'unsafe-hashed-attributes' to address backwards co… w3c/webappsec-csp#247 (8 comments by @andypaicu, @arturjanc, @briansmith, @devd, @mikewest)
-
Cleanup `global object` usage to make sense with `Documents` w3c/webappsec-csp#254 (4 comments by @andypaicu, @annevk, @mikewest)
-
Adds WorkletGlobalScope as a concept to CSP. w3c/webappsec-csp#205 (2 comments by @bfgeek, @mikewest)
-
Replace Request.type based logic with Request.destination w3c/webappsec-csp#231 (1 comment by @mikewest)
-
Add extra note for 'unsafe-inline-attributes' to address backwards co… w3c/webappsec-csp#246 (1 comment by @andypaicu)
-
w3c/webappsec-referrer-policy
-
1 issue closed.
-
"Parsing" is undefined (broken link) w3c/webappsec-referrer-policy#105.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Fix HTML link: creation URL w3c/webappsec-referrer-policy#107, by @domfarolino.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue opened.
-
Handle non-fully-active documents w3c/permissions#162, by @jan-ivar.
-
-
3 issues received 6 new comments.
-
Handle non-fully-active documents w3c/permissions#162 (3 comments by @jan-ivar, @jyasskin, @raymeskhoury)
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153 (1 comment by @jan-ivar)
-
-
1 pull request opened.
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163, by @raymeskhoury.
-
-
3 pull requests received 12 new comments.
-
Introduce "Automation" section w3c/permissions#151 (8 comments by @burg, @foolip, @gsnedders, @kereliuk, @marcoscaceres)
-
Add support for permissions that have an associated Feature Policy w3c/permissions#163 (2 comments by @raymeskhoury)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Can't clear site data while offline w3c/webappsec-clear-site-data#40, by @ithinkihaveacat.
-
-
1 issue closed.
-
Can start damo server niether with Python 2.7 nor with 3.6 w3c/webappsec-clear-site-data#35.
-
-
1 issue received 2 new comments.
-
Can't clear site data while offline w3c/webappsec-clear-site-data#40 (2 comments by @ithinkihaveacat, @msramek)
-
-
1 pull request opened.
-
Fix typos w3c/webappsec-clear-site-data#41, by @ithinkihaveacat.
-
w3c/webcrypto
-
1 issue opened.
-
Update Webidl to use WindowOrWorkerGlobalScope ? w3c/webcrypto#189, by @dstorey.
-
-
1 issue received 1 new comment.
w3c/webappsec-secure-contexts
-
5 issues closed.
-
typo: "ptovide" w3c/webappsec-secure-contexts#50.
-
Creator context security used incorrectly w3c/webappsec-secure-contexts#48.
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42.
-
Transition to CR. w3c/webappsec-secure-contexts#39.
-
Consider: isSecureContext should be [Unforgeable] w3c/webappsec-secure-contexts#46.
-
-
6 issues received 8 new comments.
-
Creator context security used incorrectly w3c/webappsec-secure-contexts#48 (2 comments by @annevk, @mikewest)
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42 (2 comments by @annevk, @mikewest)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @mikewest)
-
Consider: isSecureContext should be [Unforgeable] w3c/webappsec-secure-contexts#46 (1 comment by @annevk)
-
-
1 pull request opened.
-
Secure sheets w3c/webappsec-secure-contexts#51, by @mikewest.
-
-
1 pull request received 8 new comments.
w3c/webappsec-mixed-content
-
1 issue opened.
-
Track being the only media type that is blocked w3c/webappsec-mixed-content#13, by @RReverser.
-
-
2 issues closed.
-
Normative definition of optionally-blockable contradicts following note w3c/webappsec-mixed-content#8.
-
Remove service worker mixed content exceptions w3c/webappsec-mixed-content#12.
-
-
3 issues received 12 new comments.
-
Track being the only media type that is blocked w3c/webappsec-mixed-content#13 (6 comments by @annevk, @mikewest, @RReverser, @wanderview)
-
Normative definition of optionally-blockable contradicts following note w3c/webappsec-mixed-content#8 (3 comments by @bzbarsky, @mikewest)
-
Remove service worker mixed content exceptions w3c/webappsec-mixed-content#12 (3 comments by @aliams, @mikewest)
-
w3c/webappsec-permissions-policy
-
5 issues closed.
-
[TAG] Interaction with New Features w3c/webappsec-permissions-policy#69.
-
The implications of the default disable/enable policy are unclear w3c/webappsec-permissions-policy#48.
-
Delivery section should address new/unrecognized features and directive members w3c/webappsec-permissions-policy#47.
-
Additional feature: WebVR w3c/webappsec-permissions-policy#49.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78.
-
-
4 issues received 4 new comments.
-
[TAG] New Registry; Strategy for Updates? w3c/webappsec-permissions-policy#75 (1 comment by @clelland)
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78 (1 comment by @craigfrancis)
-
6 pull requests opened.
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webappsec-permissions-policy#91, by @foolip.
-
Clarify child inheritance w3c/webappsec-permissions-policy#90, by @clelland.
-
Clarify child inheritance w3c/webappsec-permissions-policy#89, by @clelland.
-
Don't claim that the spec defines feature names w3c/webappsec-permissions-policy#88, by @clelland.
-
Replace remaining instances of JSON-list syntax w3c/webappsec-permissions-policy#87, by @clelland.
-
Add USB and VR as features w3c/webappsec-permissions-policy#86, by @clelland.
-
-
5 pull requests merged.
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webappsec-permissions-policy#91.
-
Replace remaining instances of JSON-list syntax w3c/webappsec-permissions-policy#87.
-
Add USB and VR as features w3c/webappsec-permissions-policy#86.
-
Fix sample integration text w3c/webappsec-permissions-policy#84.
-
Update header and allow attribute syntax w3c/webappsec-permissions-policy#83.
-
-
1 pull request closed.
-
Clarify child inheritance w3c/webappsec-permissions-policy#89.
-
-
1 pull request received 9 new comments.
-
Ask for tests for normative changes in CONTRIBUTING.md w3c/webappsec-permissions-policy#91 (9 comments by @clelland, @foolip)
-
w3c/trusted-types
-
3 issues opened.
-
Bypasses via attributes w3c/trusted-types#28, by @koto.
-
Integration idea - use Symbol.hasInstance w3c/trusted-types#22, by @koto.
-
Consider surfacing sanitization fallbacks to the developer w3c/trusted-types#21, by @koto.
-
-
3 issues closed.
-
Polyfill: Integrate with web layout tests w3c/trusted-types#10.
-
Suggestion: URLs have more than one escaping context w3c/trusted-types#3.
-
Polyfill: modularize the code w3c/trusted-types#9.
-
-
1 issue received 1 new comment.
-
5 pull requests opened.
-
Added enforcement for all property setters based on the setAttribute mappings. w3c/trusted-types#27, by @koto.
-
Experimental fromTemplateLiteral API. w3c/trusted-types#26, by @koto.
-
Added eslint:recommended to linter rules. w3c/trusted-types#25, by @koto.
-
Moved from Closure goog.require/goog.provide to ES6 modules w3c/trusted-types#24, by @koto.
-
Fix documentation of TrustedURL.create w3c/trusted-types#23, by @vrana.
-
-
4 pull requests merged.
-
Added enforcement for all property setters based on the setAttribute mappings. w3c/trusted-types#27.
-
Added eslint:recommended to linter rules. w3c/trusted-types#25.
-
Moved from Closure goog.require/goog.provide to ES6 modules w3c/trusted-types#24.
-
Fix documentation of TrustedURL.create w3c/trusted-types#23.
-
w3c/webappsec
-
1 issue opened.
-
'strict-dynamic' should not be bound to only nonces/hashes w3c/webappsec#534, by @april.
-
-
1 issue received 9 new comments.
-
CSP3: Add something along the lines of `disown-window-owner`. w3c/webappsec#139 (9 comments by @andypaicu, @annevk, @bzbarsky)
-
TR publications
-
1 document published.
-
Permissions published as a Working Draft. History of Permissions
-
Participants
-
1 participant left.
-
Michael[tm] Smith (sideshowbarker) (W3C) left.
-
GitHub
w3c/webappsec-credential-management
-
2 issues received 4 new comments.
-
CREDENTIAL: Reconsider the top-level browsing context limitation. w3c/webappsec-credential-management#3 (3 comments by @AngeloKai, @battre)
-
Extensibility via "Credential Handlers" w3c/webappsec-credential-management#99 (1 comment by @dlongley)
-
-
1 pull request opened.
-
Added aborted flag to the Create and DiscoverFromExternalSource methods w3c/webappsec-credential-management#104, by @AngeloKai.
-
-
1 pull request received 3 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (3 comments by @equalsJeffH, @mikewest)
-
w3c/webappsec-csp
-
8 issues opened.
-
A kind of a nonce for a complete "zone" w3c/webappsec-csp#245, by @nico3333fr.
-
Year of CSP3 is 2016 w3c/webappsec-csp#244, by @alexmuller.
-
Any protection against dynamic module import? w3c/webappsec-csp#243, by @shhnjk.
-
Should securitypolicyviolation have element set in more cases w3c/webappsec-csp#242, by @annevk.
-
Spec incorrectly states *.example.com “matches any resource on the host”? w3c/webappsec-csp#241, by @sideshowbarker.
-
Remove worker references from child-src section w3c/webappsec-csp#239, by @dveditz.
-
child-src still mentions to govern workers w3c/webappsec-csp#238, by @ckerschb.
-
Add [Exposed] to all interfaces w3c/webappsec-csp#237, by @annevk.
-
-
1 issue closed.
-
child-src still mentions to govern workers w3c/webappsec-csp#238.
-
-
6 issues received 20 new comments.
-
Any protection against dynamic module import? w3c/webappsec-csp#243 (10 comments by @annevk, @domenic, @mozfreddyb, @shhnjk)
-
child-src still mentions to govern workers w3c/webappsec-csp#238 (5 comments by @ckerschb, @dveditz, @mikewest, @sideshowbarker)
-
The `disown-opener` directive is not the right model w3c/webappsec-csp#194 (1 comment by @laukstein)
-
-
1 pull request opened.
-
Editorial: Fix minor typos in non-normative Note w3c/webappsec-csp#240, by @sideshowbarker.
-
-
2 pull requests merged.
-
Editorial: Fix minor typos in non-normative Note w3c/webappsec-csp#240.
-
Ask for web-platform-tests in CONTRIBUTING.md w3c/webappsec-csp#230.
-
-
2 pull requests received 5 new comments.
-
Ask for web-platform-tests in CONTRIBUTING.md w3c/webappsec-csp#230 (3 comments by @foolip, @mikewest)
-
w3c/permissions
-
2 issues opened.
-
"prompt the user to choose" algorithm impedance mismatch. w3c/permissions#161, by @jan-ivar.
-
A more modest request() w3c/permissions#158, by @annevk.
-
-
3 issues closed.
-
Move to using Echidna w3c/permissions#24.
-
Drop .request() w3c/permissions#83.
-
Consider removing Permissions.revoke(). w3c/permissions#46.
-
-
4 issues received 15 new comments.
-
A more modest request() w3c/permissions#158 (9 comments by @annevk, @anssiko, @garykac, @jan-ivar, @jyasskin, @raymeskhoury, @reillyeon)
-
"prompt the user to choose" algorithm impedance mismatch. w3c/permissions#161 (2 comments by @jan-ivar, @jyasskin)
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153 (1 comment by @jyasskin)
-
-
6 pull requests opened.
-
chore: make Echidna publication actually work w3c/permissions#160, by @jyasskin.
-
Remove permissions.request() and permissions.revoke(). w3c/permissions#159, by @jyasskin.
-
docs: Restore pieces of CONTRIBUTING.md lost in abe8198c22. w3c/permissions#157, by @jyasskin.
-
Fix the links to permissions defined in other specs. w3c/permissions#156, by @jyasskin.
-
Add ClipboardPermissionDescriptor w3c/permissions#155, by @garykac.
-
Clarify "new information about the user’s intent" definition w3c/permissions#154, by @anssiko.
-
-
5 pull requests merged.
-
docs: Restore pieces of CONTRIBUTING.md lost in abe8198c22. w3c/permissions#157.
-
chore: make Echidna publication actually work w3c/permissions#160.
-
Remove permissions.request() and permissions.revoke(). w3c/permissions#159.
-
Fix the links to permissions defined in other specs. w3c/permissions#156.
-
Clarify "new information about the user’s intent" definition w3c/permissions#154.
-
-
1 pull request closed.
-
chore(perm interface): Fix return value handling w3c/permissions#143.
-
-
5 pull requests received 43 new comments.
-
Introduce "Automation" section w3c/permissions#151 (16 comments by @foolip, @guidou, @jugglinmike, @jyasskin, @kereliuk)
-
Clarify "new information about the user’s intent" definition w3c/permissions#154 (15 comments by @anssiko, @jyasskin)
-
Add ClipboardPermissionDescriptor w3c/permissions#155 (8 comments by @garykac, @jyasskin, @marcoscaceres, @martinthomson)
-
Remove permissions.request() and permissions.revoke(). w3c/permissions#159 (3 comments by @jan-ivar, @jyasskin)
-
w3c/trusted-types
-
11 issues opened.
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11, by @mikewest.
-
Polyfill: Integrate with web layout tests w3c/trusted-types#10, by @koto.
-
Polyfill: modularize the code w3c/trusted-types#9, by @koto.
-
Figure out if TrustedURL needs to be absolute. w3c/trusted-types#8, by @koto.
-
Semantics and naming of types w3c/trusted-types#7, by @xtofian.
-
Handling of dependent types w3c/trusted-types#6, by @xtofian.
-
Investigate what to do with <link>. w3c/trusted-types#5, by @koto.
-
Is it possible to lock things down to string constants? w3c/trusted-types#4, by @mikewest.
-
Suggestion: URLs have more than one escaping context w3c/trusted-types#3, by @granthusbands.
-
`TreatNullAs` behavior for `innerHTML`, et al. is unclear. w3c/trusted-types#2, by @mikewest.
-
Suggestion: Use different switch/flag than CSP w3c/trusted-types#1, by @mozfreddyb.
-
-
1 issue closed.
-
Investigate what to do with <link>. w3c/trusted-types#5.
-
-
7 issues received 19 new comments.
-
Suggestion: Use different switch/flag than CSP w3c/trusted-types#1 (11 comments by @koto, @mikewest, @mozfreddyb)
-
Override `.innerHTML`, or define `safelySetInnerHTML(...)`? w3c/trusted-types#11 (3 comments by @koto, @mozfreddyb)
-
-
9 pull requests opened.
-
Synchronized polyfill API with the native implementation. w3c/trusted-types#20, by @koto.
-
Added a w3c platform tests runner w3c/trusted-types#19, by @koto.
-
Add enforcement for setAttribute w3c/trusted-types#18, by @slekies.
-
Added script.src tests to the demo. w3c/trusted-types#17, by @koto.
-
Fixed the tests. w3c/trusted-types#16, by @koto.
-
Enabled Closure's advanced compilation w3c/trusted-types#15, by @koto.
-
Refactoring to prepare the introduction of the setAttribute wrapper w3c/trusted-types#14, by @slekies.
-
Added a dummy TrustedScriptURL, for now not inheriting from TrustedURL. w3c/trusted-types#13, by @koto.
-
Add pre-commit hooks. w3c/trusted-types#12, by @MrDisconnect.
-
-
9 pull requests merged.
-
Synchronized polyfill API with the native implementation. w3c/trusted-types#20.
-
Added a w3c platform tests runner w3c/trusted-types#19.
-
Add enforcement for setAttribute w3c/trusted-types#18.
-
Added script.src tests to the demo. w3c/trusted-types#17.
-
Fixed the tests. w3c/trusted-types#16.
-
Enabled Closure's advanced compilation w3c/trusted-types#15.
-
Refactoring to prepare the introduction of the setAttribute wrapper w3c/trusted-types#14.
-
Added a dummy TrustedScriptURL, for now not inheriting from TrustedURL. w3c/trusted-types#13.
-
Add pre-commit hooks. w3c/trusted-types#12.
-
w3c/webappsec-suborigins
-
6 issues opened.
-
Integration with the Storage Standard w3c/webappsec-suborigins#78, by @annevk.
-
Consider renaming unsafe-postmessage-* to unsafe-window-postmessage-* w3c/webappsec-suborigins#77, by @annevk.
-
Tradeoff between unsafe-* and refactoring w3c/webappsec-suborigins#76, by @annevk.
-
Remove unsafe-cookies w3c/webappsec-suborigins#75, by @annevk.
-
Alternate `postMessage()` design w3c/webappsec-suborigins#74, by @annevk.
-
Alternate CORS design w3c/webappsec-suborigins#73, by @annevk.
-
-
8 issues received 9 new comments.
-
Make workers (including service workers) work w3c/webappsec-suborigins#21 (2 comments by @annevk, @jakearchibald)
-
Suborigin cookies should not be treated as third-party w3c/webappsec-suborigins#43 (1 comment by @annevk)
-
document.suborigin or something should allow JS to detect if in suborigin w3c/webappsec-suborigins#35 (1 comment by @annevk)
-
w3c/webappsec-clear-site-data
-
3 issues opened.
-
Regenerate https://www.w3.org/TR/clear-site-data/ w3c/webappsec-clear-site-data#39, by @vrana.
-
Is registerProtocolHandler() affected? w3c/webappsec-clear-site-data#37, by @annevk.
-
Can start damo server niether with Python 2.7 nor with 3.6 w3c/webappsec-clear-site-data#35, by @life777.
-
-
2 issues received 11 new comments.
-
Setting and clearing data in same response w3c/webappsec-clear-site-data#33 (7 comments by @annevk, @jimbo2150, @slightlyoff, @triblondon)
-
Is registerProtocolHandler() affected? w3c/webappsec-clear-site-data#37 (4 comments by @annevk, @domenic)
-
-
2 pull requests opened.
-
Fix examples w3c/webappsec-clear-site-data#38, by @vrana.
-
Update server file to be used with Python 3 w3c/webappsec-clear-site-data#36, by @life777.
-
-
1 pull request closed.
-
Fix examples w3c/webappsec-clear-site-data#38.
-
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Allow document.cookie and maybe Set-Cookie from the server to be controlled w3c/webappsec-permissions-policy#85, by @annevk.
-
-
1 issue closed.
-
The WebIDL in section 2.4.1 cookie redefines document.cookie w3c/webappsec-permissions-policy#42.
-
-
4 issues received 14 new comments.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78 (8 comments by @clelland, @craigfrancis, @loonybear, @reschke)
-
Allow document.cookie and maybe Set-Cookie from the server to be controlled w3c/webappsec-permissions-policy#85 (3 comments by @annevk, @clelland)
-
The WebIDL in section 2.4.1 cookie redefines document.cookie w3c/webappsec-permissions-policy#42 (2 comments by @annevk, @tobie)
-
Provide example(s) of enabling disabled-by-default feature(s) w3c/webappsec-permissions-policy#45 (1 comment by @craigfrancis)
-
-
1 pull request opened.
-
Fix sample integration text w3c/webappsec-permissions-policy#84, by @clelland.
-
w3c/webcrypto
-
1 pull request opened.
-
Fix reference to `plaintext` variable in AES-GCM decrypt algorithm description w3c/webcrypto#188, by @harrishancock.
-
-
1 pull request received 1 new comment.
-
Fix reference to `plaintext` variable in AES-GCM decrypt algorithm description w3c/webcrypto#188 (1 comment by @harrishancock)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Remove service worker mixed content exceptions w3c/webappsec-mixed-content#12, by @aliams.
-
-
1 issue closed.
-
ТРАБЛА В КОДЕ w3c/webappsec-mixed-content#10.
-
w3c/webappsec-subresource-integrity
-
1 issue received 9 new comments.
-
Consider integrity enforcement of iframe w3c/webappsec-subresource-integrity#21 (9 comments by @annevk, @dlongley, @mikewest)
-
-
1 pull request opened.
-
Update index.bs w3c/webappsec-subresource-integrity#74, by @markafoltz.
-
-
1 pull request merged.
-
Update index.bs w3c/webappsec-subresource-integrity#74.
-
-
1 pull request received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
Intersection Observer review w3c/webappsec#533, by @LJWatson.
-
-
1 issue closed.
-
CSP: Refused to execute inline script even with a valid sha1 or sha256 w3c/webappsec#400.
-
-
1 issue received 1 new comment.
-
CSP: Refused to execute inline script even with a valid sha1 or sha256 w3c/webappsec#400 (1 comment by @WebReflection)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
8.4 Minor wording inconsistency w3c/webappsec-referrer-policy#106, by @thiemonagel.
-
w3c/webappsec-cowl
-
1 issue opened.
-
incumbent settings object? w3c/webappsec-cowl#74, by @ak-14.
-
TR publications
-
1 document published.
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Participants
-
1 participant joined.
-
Liam Quin (W3C) joined.
-
-
1 participant left.
-
Josh Soref (W3C Invited Experts) left.
-
-
1 organization joined.
-
HM Government joined.
-
GitHub
w3c/webappsec-csp
-
7 issues opened.
-
Case-sensitivity resulting in divergent browser behavior w3c/webappsec-csp#236, by @april.
-
Should frame-src control frames with "local scheme"? w3c/webappsec-csp#235, by @ameshkov.
-
script-src chapter should mention worker-src w3c/webappsec-csp#234, by @annevk.
-
CSP3: Can be possible adding a `max-age` or `expiration` to remember the CSP? w3c/webappsec-csp#233, by @inkeliz.
-
Permission for browser extensions w3c/webappsec-csp#232, by @leodutra.
-
allow calls to new Function(); - but not to the actual constructed function. under csp unsafe-eval. w3c/webappsec-csp#229, by @graingert.
-
Introduce rate limiting for violation reports (report-uri and report-to) w3c/webappsec-csp#227, by @danmx.
-
-
1 issue closed.
-
Introduce rate limiting for violation reports (report-uri and report-to) w3c/webappsec-csp#227.
-
-
3 issues received 9 new comments.
-
Introduce rate limiting for violation reports (report-uri and report-to) w3c/webappsec-csp#227 (5 comments by @danmx, @devd, @jacobbednarz, @michaelficarra, @mikewest)
-
Case-sensitivity resulting in divergent browser behavior w3c/webappsec-csp#236 (3 comments by @april, @dveditz)
-
-
3 pull requests opened.
-
Replace Request.type based logic with Request.destination w3c/webappsec-csp#231, by @yoavweiss.
-
Ask for web-platform-tests in CONTRIBUTING.md w3c/webappsec-csp#230, by @foolip.
-
link up inline css issue w3c/webappsec-csp#228, by @graingert.
-
-
3 pull requests received 36 new comments.
-
Replace Request.type based logic with Request.destination w3c/webappsec-csp#231 (30 comments by @annevk, @mikewest, @yoavweiss)
-
Adds WorkletGlobalScope as a concept to CSP. w3c/webappsec-csp#205 (4 comments by @annevk, @bfgeek, @mikewest)
-
w3c/webappsec-permissions-policy
-
3 issues received 4 new comments.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78 (2 comments by @clelland, @raymeskhoury)
-
-
2 pull requests opened.
-
Update header and allow attribute syntax w3c/webappsec-permissions-policy#83, by @clelland.
-
Update section on 'Other and related mechanisms' w3c/webappsec-permissions-policy#82, by @clelland.
-
w3c/webappsec
-
1 issue opened.
-
Content-Security-Policy didn't get into the IANA message header registry w3c/webappsec#532, by @jyasskin.
-
-
1 issue received 1 new comment.
w3c/permissions
-
1 pull request received 5 new comments.
-
Introduce "Automation" section w3c/permissions#151 (5 comments by @foolip, @jugglinmike, @marcoscaceres, @raymeskhoury)
-
w3c/webappsec-credential-management
-
5 issues opened.
-
#credential-internal-methods section is sort of confusing w3c/webappsec-credential-management#103, by @equalsJeffH.
-
Require call to navigator.credentials.store before sharing credentials across subdomains w3c/webappsec-credential-management#102, by @lawnsea.
-
RFC2119 terms upper-cased tho "document conventions" says otherwise w3c/webappsec-credential-management#101, by @equalsJeffH.
-
Extensibility via "Credential Handlers" w3c/webappsec-credential-management#99, by @dlongley.
-
Spec is unclear on what the promise returned by store() is resolved with (Credential/undefined) w3c/webappsec-credential-management#98, by @ghost.
-
-
4 issues received 11 new comments.
-
Require call to navigator.credentials.store before sharing credentials across subdomains w3c/webappsec-credential-management#102 (4 comments by @battre, @lawnsea)
-
accessing settings object from in-parallel steps? w3c/webappsec-credential-management#92 (4 comments by @equalsJeffH, @mikewest)
-
#credential-internal-methods section is sort of confusing w3c/webappsec-credential-management#103 (2 comments by @equalsJeffH)
-
Find a way to avoid exposing a user password to the web page w3c/webappsec-credential-management#96 (1 comment by @battre)
-
-
1 pull request opened.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100, by @equalsJeffH.
-
-
2 pull requests received 23 new comments.
-
issue 92 accessing settings object: add passing global and queue task invoke algorithm w3c/webappsec-credential-management#100 (21 comments by @domenic, @equalsJeffH, @mikewest)
-
Resolve issues of accessing settings object in parallel steps w3c/webappsec-credential-management#93 (2 comments by @equalsJeffH)
-
w3c/webappsec-mixed-content
-
1 pull request opened.
-
Replace Request type with destination w3c/webappsec-mixed-content#11, by @yoavweiss.
-
-
1 pull request merged.
-
Replace Request type with destination w3c/webappsec-mixed-content#11.
-
-
1 pull request received 3 new comments.
-
Replace Request type with destination w3c/webappsec-mixed-content#11 (3 comments by @annevk, @yoavweiss)
-
w3c/webcrypto
-
3 issues received 3 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @daviddias)
w3c/webappsec-referrer-policy
-
1 issue received 2 new comments.
-
Add referrer policy `origin-when-downgrade` w3c/webappsec-referrer-policy#94 (2 comments by @annevk, @pulzarraider)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue closed.
-
Hello w3c/webappsec-upgrade-insecure-requests#9.
-
w3c/webappsec-cowl
-
1 issue opened.
-
example 23 is uggy w3c/webappsec-cowl#73, by @deian.
-
w3c/webappsec-clear-site-data
-
4 issues opened.
-
Position of Serviceworkers w3c/webappsec-clear-site-data#34, by @triblondon.
-
Setting and clearing data in same response w3c/webappsec-clear-site-data#33, by @triblondon.
-
Clear all option '*' w3c/webappsec-clear-site-data#32, by @triblondon.
-
Explainer w3c/webappsec-clear-site-data#31, by @triblondon.
-
-
1 issue received 1 new comment.
GitHub
w3c/webcrypto
-
2 issues received 2 new comments.
w3c/webappsec-mixed-content
-
1 issue opened.
-
ТРАБЛА В КОДЕ w3c/webappsec-mixed-content#10, by @DonGlazikBro.
-
w3c/webappsec-csp
-
2 issues opened.
-
Prefer blocking fall-through conditions w3c/webappsec-csp#226, by @aidantwoods.
-
-
1 issue closed.
-
Add onsecuritypolicyviolation to the spec w3c/webappsec-csp#184.
-
-
3 issues received 3 new comments.
w3c/webappsec-credential-management
-
4 issues opened.
-
PasswordCredential(HTMLFormElement form) constructor inherently racey w3c/webappsec-credential-management#97, by @dsanders11.
-
Find a way to avoid exposing a user password to the web page w3c/webappsec-credential-management#96, by @dbates-wk.
-
How do web pages incorporate Credential Management API in a backwards compatible way? w3c/webappsec-credential-management#95, by @dbates-wk.
-
User mediated credential access limits user agent UI w3c/webappsec-credential-management#94, by @dbates-wk.
-
-
4 issues received 19 new comments.
-
Find a way to avoid exposing a user password to the web page w3c/webappsec-credential-management#96 (7 comments by @battre, @dbates-wk, @mikewest)
-
How do web pages incorporate Credential Management API in a backwards compatible way? w3c/webappsec-credential-management#95 (6 comments by @dbates-wk, @mikewest)
-
User mediated credential access limits user agent UI w3c/webappsec-credential-management#94 (5 comments by @dbates-wk, @mikewest)
-
accessing settings object from in-parallel steps? w3c/webappsec-credential-management#92 (1 comment by @battre)
-
-
1 pull request opened.
-
Resolve issues of accessing settings object in parallel steps w3c/webappsec-credential-management#93, by @battre.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
typo: "ptovide" w3c/webappsec-secure-contexts#50, by @thiemonagel.
-
w3c/webappsec-cowl
-
2 issues opened.
-
Fetching images dynamically pitfall w3c/webappsec-cowl#72, by @ak-14.
-
Should Privilege objects be serializable? w3c/webappsec-cowl#71, by @ak-14.
-
-
1 issue received 1 new comment.
w3c/webappsec-referrer-policy
-
2 issues closed.
-
Add referrer policy `origin-when-downgrade` w3c/webappsec-referrer-policy#94.
-
Update web-platform-tests w3c/webappsec-referrer-policy#57.
-
w3c/webappsec-permissions-policy
-
1 issue closed.
-
[TAG] Inconsistent granularity w3c/webappsec-permissions-policy#70.
-
-
4 issues received 11 new comments.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78 (7 comments by @clelland, @domenic, @igrigorik, @loonybear, @raymeskhoury)
-
[TAG] New Registry; Strategy for Updates? w3c/webappsec-permissions-policy#75 (2 comments by @clelland, @raymeskhoury)
-
w3c/webappsec
-
1 issue received 1 new comment.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
any command for node and angular gives this error w3c/webappsec-subresource-integrity#73, by @anurag545.
-
-
2 issues closed.
-
any command for node and angular gives this error w3c/webappsec-subresource-integrity#73.
-
If the FetchEvent returns the integrity value w3c/webappsec-subresource-integrity#71.
-
-
1 issue received 1 new comment.
-
any command for node and angular gives this error w3c/webappsec-subresource-integrity#73 (1 comment by @devd)
-
w3c/permissions
-
1 issue received 2 new comments.
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153 (2 comments by @jugglinmike, @raymeskhoury)
-
-
1 pull request received 3 new comments.
GitHub
w3c/webappsec-credential-management
-
3 issues opened.
-
accessing settings object from in-parallel steps? w3c/webappsec-credential-management#92, by @equalsJeffH.
-
CredentialCreationOptions does not need to have nullable members. w3c/webappsec-credential-management#90, by @battre.
-
[SameObject] should not be used on DOMString/USVString w3c/webappsec-credential-management#88, by @qdot.
-
-
5 issues closed.
-
Consider renaming `requireUserMediation()`. w3c/webappsec-credential-management#74.
-
should incumbent settings object be relevant settings object? w3c/webappsec-credential-management#53.
-
Update body-extraction algorithm to match Fetch spec w3c/webappsec-credential-management#49.
-
CredentialCreationOptions does not need to have nullable members. w3c/webappsec-credential-management#90.
-
[SameObject] should not be used on DOMString/USVString w3c/webappsec-credential-management#88.
-
-
4 issues received 10 new comments.
-
accessing settings object from in-parallel steps? w3c/webappsec-credential-management#92 (7 comments by @bzbarsky, @equalsJeffH)
-
should incumbent settings object be relevant settings object? w3c/webappsec-credential-management#53 (1 comment by @equalsJeffH)
-
Consider renaming `requireUserMediation()`. w3c/webappsec-credential-management#74 (1 comment by @equalsJeffH)
-
Update body-extraction algorithm to match Fetch spec w3c/webappsec-credential-management#49 (1 comment by @vabr-g)
-
-
2 pull requests opened.
-
Remove nullability in places where they are not necessary w3c/webappsec-credential-management#91, by @battre.
-
Drop [SameObject] from strings w3c/webappsec-credential-management#89, by @battre.
-
-
2 pull requests merged.
-
Drop [SameObject] from strings w3c/webappsec-credential-management#89.
-
Remove nullability in places where they are not necessary w3c/webappsec-credential-management#91.
-
-
1 pull request closed.
-
Update 'Extract body' algorithm to fit in the latest Fetch spec w3c/webappsec-credential-management#50.
-
-
3 pull requests received 3 new comments.
-
Update 'Extract body' algorithm to fit in the latest Fetch spec w3c/webappsec-credential-management#50 (1 comment by @vabr-g)
-
Remove nullability in places where they are not necessary w3c/webappsec-credential-management#91 (1 comment by @mikewest)
-
w3c/permissions
-
3 issues opened.
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153, by @jugglinmike.
-
Capability Model w3c/permissions#148, by @RichardMaher.
-
Request `Fullscreen` state w3c/permissions#147, by @RichardMaher.
-
-
5 issues received 26 new comments.
-
Flesh out request("geolocation") w3c/permissions#112 (11 comments by @jakearchibald, @jan-ivar, @marcoscaceres, @RichardMaher)
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153 (4 comments by @jugglinmike, @jyasskin, @raymeskhoury)
-
Could we ask for several permissions at a time ? w3c/permissions#6 (4 comments by @marcoscaceres, @RichardMaher)
-
-
3 pull requests opened.
-
Add support for pr-preview w3c/permissions#152, by @tobie.
-
Introduce "Automation" section w3c/permissions#151, by @jugglinmike.
-
chore(example): Escape special character w3c/permissions#149, by @jugglinmike.
-
-
2 pull requests merged.
-
Add support for pr-preview w3c/permissions#152.
-
Link generic sensor permission revocation algorithm and fix note links w3c/permissions#146.
-
-
3 pull requests received 32 new comments.
-
Introduce "Automation" section w3c/permissions#151 (23 comments by @foolip, @jugglinmike, @raymeskhoury)
-
chore(example): Escape special character w3c/permissions#149 (5 comments by @marcoscaceres, @tabatkins)
-
Link generic sensor permission revocation algorithm and fix note links w3c/permissions#146 (4 comments by @anssiko, @marcoscaceres)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
"Parsing" is undefined (broken link) w3c/webappsec-referrer-policy#105, by @aidantwoods.
-
-
1 issue received 5 new comments.
-
"Parsing" is undefined (broken link) w3c/webappsec-referrer-policy#105 (5 comments by @aidantwoods, @annevk, @mikewest)
-
-
1 pull request merged.
-
Add a link to web-platform-tests to the top of the spec w3c/webappsec-referrer-policy#103.
-
-
1 pull request received 1 new comment.
-
Add a link to web-platform-tests to the top of the spec w3c/webappsec-referrer-policy#103 (1 comment by @estark37)
-
w3c/webappsec-csp
-
1 issue opened.
-
Unable to parse IPv6 addresses in CSP source list w3c/webappsec-csp#224, by @skateman.
-
-
2 issues received 4 new comments.
-
1 pull request opened.
-
Link to wpt for Embedded Enforcement w3c/webappsec-csp#223, by @foolip.
-
-
1 pull request merged.
-
Link to wpt for Embedded Enforcement w3c/webappsec-csp#223.
-
-
2 pull requests received 5 new comments.
-
Fixed nonce matching in source expression subsumption algorithm w3c/webappsec-csp#222 (3 comments by @andypaicu, @arturjanc)
-
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Bikeshed generated a garbage at the top w3c/webappsec-subresource-integrity#72, by @tyoshino.
-
If the FetchEvent returns the integrity value w3c/webappsec-subresource-integrity#71, by @xzhan96.
-
-
1 issue reopened.
-
If the FetchEvent returns the integrity value w3c/webappsec-subresource-integrity#71, by @xzhan96.
-
-
1 issue received 8 new comments.
-
If the FetchEvent returns the integrity value w3c/webappsec-subresource-integrity#71 (8 comments by @jakearchibald, @makotoshimazu, @mfalken, @wanderview, @xzhan96)
-
w3c/webappsec-clear-site-data
-
4 issues opened.
-
add support for clearing HTTP authentication data (as per RFC 7235) w3c/webappsec-clear-site-data#30, by @reschke.
-
Force close Indexed DB connections before deleting w3c/webappsec-clear-site-data#29, by @inexorabletash.
-
Ensure that more complicated filters are possible to add in the future. w3c/webappsec-clear-site-data#27, by @mikewest.
-
The header should not be cacheable w3c/webappsec-clear-site-data#26, by @msramek.
-
-
2 issues closed.
-
add support for clearing HTTP authentication data (as per RFC 7235) w3c/webappsec-clear-site-data#30.
-
Ensure that more complicated filters are possible to add in the future. w3c/webappsec-clear-site-data#27.
-
-
3 issues received 5 new comments.
-
The header should not be cacheable w3c/webappsec-clear-site-data#26 (3 comments by @mikewest, @mnot, @msramek)
-
add support for clearing HTTP authentication data (as per RFC 7235) w3c/webappsec-clear-site-data#30 (1 comment by @reschke)
-
Ensure that more complicated filters are possible to add in the future. w3c/webappsec-clear-site-data#27 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Change the demo to new header syntax. w3c/webappsec-clear-site-data#28, by @msramek.
-
-
1 pull request merged.
-
Change the demo to new header syntax. w3c/webappsec-clear-site-data#28.
-
w3c/webappsec
-
1 issue opened.
-
[SRI] Clarification regarding "Parse metadata" algorithm w3c/webappsec#531, by @hrj.
-
-
1 issue received 2 new comments.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78, by @LoonyBean.
-
-
3 issues received 3 new comments.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78 (1 comment by @LoonyBean)
-
Support for enable/disable attribute on iframes w3c/webappsec-permissions-policy#11 (1 comment by @LoonyBean)
-
-
3 pull requests opened.
-
Reference features.md from spec; fix headings in features doc w3c/webappsec-permissions-policy#81, by @clelland.
-
Add guide for integrating new features with FP w3c/webappsec-permissions-policy#80, by @clelland.
-
Remove appendix from spec w3c/webappsec-permissions-policy#79, by @clelland.
-
-
3 pull requests merged.
-
Add guide for integrating new features with FP w3c/webappsec-permissions-policy#80.
-
Reference features.md from spec; fix headings in features doc w3c/webappsec-permissions-policy#81.
-
Remove appendix from spec w3c/webappsec-permissions-policy#79.
-
-
1 pull request closed.
-
Change "eme" feature to "encrypted-media" w3c/webappsec-permissions-policy#66.
-
-
2 pull requests received 8 new comments.
-
Add guide for integrating new features with FP w3c/webappsec-permissions-policy#80 (7 comments by @clelland, @raymeskhoury)
-
Change "eme" feature to "encrypted-media" w3c/webappsec-permissions-policy#66 (1 comment by @clelland)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Why are documents with insecure frames treated as secure contexts? w3c/webappsec-secure-contexts#49, by @arturjanc.
-
-
1 issue closed.
-
Why are documents with insecure frames treated as secure contexts? w3c/webappsec-secure-contexts#49.
-
-
1 issue received 2 new comments.
-
Why are documents with insecure frames treated as secure contexts? w3c/webappsec-secure-contexts#49 (2 comments by @arturjanc, @mikewest)
-
w3c/webcrypto
-
1 issue received 1 new comment.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @alanwaketan)
-
Participants
-
3 participants joined.
-
Wendy Seltzer (W3C) joined.
-
Malika Aubakirova (W3C Invited Experts) joined.
-
Niklas Andreasson (W3C Invited Experts) joined.
-
-
5 organizations joined.
-
Microsoft Corporation joined.
-
Deutsche Telekom AG joined.
-
X joined.
-
GitStar joined.
-
Apple Inc. joined.
-
GitHub
w3c/permissions
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Link generic sensor permission revocation algorithm and fix note links w3c/permissions#146, by @anssiko.
-
-
1 pull request merged.
-
Define restrictions on "device-info" permission (from TPAC). w3c/permissions#131.
-
-
2 pull requests received 2 new comments.
-
Link generic sensor permission revocation algorithm and fix note links w3c/permissions#146 (1 comment by @anssiko)
-
Define restrictions on "device-info" permission (from TPAC). w3c/permissions#131 (1 comment by @jan-ivar)
-
w3c/webappsec-csp
-
5 issues opened.
-
Embedded Enforcement: Ignore nonce-source values in the subsumption check w3c/webappsec-csp#221, by @arturjanc.
-
EE: Rename `Required-CSP` to `Sec-Required-CSP` w3c/webappsec-csp#219, by @mikewest.
-
CSP3: Consider adding a 'no-console-log' directive w3c/webappsec-csp#217, by @april.
-
A question about "A server SHOULD NOT send more than one [CSP header]" w3c/webappsec-csp#216, by @bluetech.
-
Multiple CSP headers restriction is unclear w3c/webappsec-csp#215, by @ameshkov.
-
-
41 issues closed.
-
EE: Rename `Required-CSP` to `Sec-Required-CSP` w3c/webappsec-csp#219.
-
Embedded Enforcement: Ignore nonce-source values in the subsumption check w3c/webappsec-csp#221.
-
A question about "A server SHOULD NOT send more than one [CSP header]" w3c/webappsec-csp#216.
-
Multiple CSP headers restriction is unclear w3c/webappsec-csp#215.
-
Stricter attribute parsing w3c/webappsec-csp#175.
-
Potential problem with CSP reporting w3c/webappsec-csp#181.
-
Make `unsafe-hashed-attributes' less unsafe w3c/webappsec-csp#147.
-
Add ability to specify the version of used CSP w3c/webappsec-csp#189.
-
Add a warning in the spec about the importance of base-uri for nonce-based policies w3c/webappsec-csp#177.
-
Spec refers to "subresource" Fetch destination w3c/webappsec-csp#172.
-
"Does path A match path B?" is incorrect w3c/webappsec-csp#171.
-
Clarify matching expressions with `host-source` but without `scheme-source` w3c/webappsec-csp#166.
-
`scheme-source` matching algorithm skips port matching w3c/webappsec-csp#162.
-
Interaction of CSP and javascript: URLs in iframe src is not defined anywhere w3c/webappsec-csp#127.
-
Allow IP or range of IPs ? w3c/webappsec-csp#75.
-
Copy/paste the "paths and redirects" justification from CSP2. w3c/webappsec-csp#46.
-
Note that the `source-file` could leak data. w3c/webappsec-csp#47.
-
Matching base64 values (hashes and nonces). w3c/webappsec-csp#188.
-
Add something like `'secure-contexts'` to `frame-ancestors`'s source list. w3c/webappsec-csp#23.
-
"Does request violate policy" algorithm 6.6.1.1 doesn't accumulate violated directives w3c/webappsec-csp#195.
-
CSP3: handling paths for redirected targets will be safe again w3c/webappsec-csp#190.
-
Consider treating non-special schemes like local schemes w3c/webappsec-csp#69.
-
Nested browsing context navigation to non-network schemes w3c/webappsec-csp#77.
-
Allow "inline" violation reports to contain the text of offending scripts w3c/webappsec-csp#119.
-
Chrome throws a SecurityError while Firefox does not w3c/webappsec-csp#120.
-
Does CSP3+Fetch apply to redirects correctly? w3c/webappsec-csp#134.
-
[document] plugin-types clarification w3c/webappsec-csp#58.
-
Consider a style-src keyword to allow style attributes but not <style> elements w3c/webappsec-csp#202.
-
Consider enforcing default port if expression matches only scheme-source grammar w3c/webappsec-csp#41.
-
Create a mechanism to disable `document.cookie` and `document.domain`. w3c/webappsec-csp#42.
-
Note the importance of the Fetch integration in /cookies/ w3c/webappsec-csp#43.
-
Copy/paste http://www.w3.org/TR/CSP2/#frame-ancestors-and-frame-options w3c/webappsec-csp#48.
-
[embedded] Is the `csp` attribute policy applied recursively? w3c/webappsec-csp#50.
-
Null references in specification w3c/webappsec-csp#39.
-
Consider applying both `child-src` and `script-src` to workers. w3c/webappsec-csp#31.
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec-csp#10.
-
CSP: Evaluate a JSON syntax. w3c/webappsec-csp#18.
-
Nonce attribute for Web Worker w3c/webappsec-csp#15.
-
CSP: Consider an opt-in cascade model. w3c/webappsec-csp#12.
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec-csp#11.
-
CSP: make available a reliable method for obtaining a reference to the global object w3c/webappsec-csp#2.
-
-
54 issues received 104 new comments.
-
CSP3: Consider adding a 'no-console-log' directive w3c/webappsec-csp#217 (10 comments by @annevk, @april, @domenic, @michaelficarra, @Zirro)
-
Inline style bits are very unclear w3c/webappsec-csp#212 (8 comments by @annevk, @bzbarsky, @mikewest)
-
do we want a directive to control postMessage explicit channels outbound? w3c/webappsec-csp#117 (8 comments by @annevk, @arturjanc, @devd, @mikewest)
-
Add something like `'secure-contexts'` to `frame-ancestors`'s source list. w3c/webappsec-csp#23 (6 comments by @annevk, @mikewest)
-
Embedded Enforcement: Ignore nonce-source values in the subsumption check w3c/webappsec-csp#221 (4 comments by @andypaicu, @arturjanc, @mikewest)
-
Interaction of CSP and javascript: URLs in iframe src is not defined anywhere w3c/webappsec-csp#127 (4 comments by @bzbarsky, @mikewest)
-
Multiple CSP headers restriction is unclear w3c/webappsec-csp#215 (4 comments by @ameshkov, @annevk)
-
Thoughts on letting CSP govern attributes that must appear in Set-Cookie w3c/webappsec-csp#152 (2 comments by @aidantwoods, @mikewest)
-
A question about "A server SHOULD NOT send more than one [CSP header]" w3c/webappsec-csp#216 (2 comments by @bluetech, @devd)
-
Setting policy when origins are not known ahead of time w3c/webappsec-csp#24 (2 comments by @mikewest, @sandinmyjoints)
-
"Does request violate policy" algorithm 6.6.1.1 doesn't accumulate violated directives w3c/webappsec-csp#195 (2 comments by @chaals, @mikewest)
-
Note somewhere that redirects are covered by fetch directives. w3c/webappsec-csp#72 (2 comments by @mikewest, @ptoomey3)
-
[document] plugin-types clarification w3c/webappsec-csp#58 (2 comments by @jonathanKingston, @mikewest)
-
[embedded] Is the `csp` attribute policy applied recursively? w3c/webappsec-csp#50 (2 comments by @mikewest)
-
Add a warning in the spec about the importance of base-uri for nonce-based policies w3c/webappsec-csp#177 (1 comment by @mikewest)
-
Clarify matching expressions with `host-source` but without `scheme-source` w3c/webappsec-csp#166 (1 comment by @mikewest)
-
`scheme-source` matching algorithm skips port matching w3c/webappsec-csp#162 (1 comment by @mikewest)
-
Consider treating non-special schemes like local schemes w3c/webappsec-csp#69 (1 comment by @mikewest)
-
Nested browsing context navigation to non-network schemes w3c/webappsec-csp#77 (1 comment by @mikewest)
-
Allow "inline" violation reports to contain the text of offending scripts w3c/webappsec-csp#119 (1 comment by @mikewest)
-
Consider a style-src keyword to allow style attributes but not <style> elements w3c/webappsec-csp#202 (1 comment by @mikewest)
-
Consider enforcing default port if expression matches only scheme-source grammar w3c/webappsec-csp#41 (1 comment by @mikewest)
-
Create a mechanism to disable `document.cookie` and `document.domain`. w3c/webappsec-csp#42 (1 comment by @mikewest)
-
Note the importance of the Fetch integration in /cookies/ w3c/webappsec-csp#43 (1 comment by @mikewest)
-
Copy/paste http://www.w3.org/TR/CSP2/#frame-ancestors-and-frame-options w3c/webappsec-csp#48 (1 comment by @mikewest)
-
Consider applying both `child-src` and `script-src` to workers. w3c/webappsec-csp#31 (1 comment by @mikewest)
-
Identify requirements for other documents defining new directives w3c/webappsec-csp#28 (1 comment by @mikewest)
-
CSP: Consider allowing `frame-ancestors` to work for subresource loads. w3c/webappsec-csp#17 (1 comment by @mikewest)
-
CSP section 4.2.2 step 8 restricts loopback allowance to 127.0.0.1 w3c/webappsec-csp#10 (1 comment by @mikewest)
-
CSP section 4.2.2 step 2 performs case sensitive test for url scheme w3c/webappsec-csp#11 (1 comment by @mikewest)
-
CSP: make available a reliable method for obtaining a reference to the global object w3c/webappsec-csp#2 (1 comment by @mikewest)
-
-
5 pull requests opened.
-
Fixed nonce matching in source expression subsumption algorithm w3c/webappsec-csp#222, by @andypaicu.
-
Renamed Required-CSP to Sec-Required-CSP w3c/webappsec-csp#220, by @andypaicu.
-
Renamed embedded csp header to requires csp w3c/webappsec-csp#218, by @andypaicu.
-
Track the source of a given policy. w3c/webappsec-csp#214, by @mikewest.
-
Enable pr-preview w3c/webappsec-csp#213, by @tobie.
-
-
8 pull requests merged.
-
Fixed nonce matching in source expression subsumption algorithm w3c/webappsec-csp#222.
-
Renamed Required-CSP to Sec-Required-CSP w3c/webappsec-csp#220.
-
Track the source of a given policy. w3c/webappsec-csp#214.
-
Renamed embedded csp header to requires csp w3c/webappsec-csp#218.
-
EE: Similarity of two source expressions w3c/webappsec-csp#180.
-
EE: Fixing spaces w3c/webappsec-csp#179.
-
Fixes "Does path A match path B?" w3c/webappsec-csp#183.
-
Enable pr-preview w3c/webappsec-csp#213.
-
-
1 pull request closed.
-
Make algo 6.6.1.1 accumulate violated directives w3c/webappsec-csp#196.
-
-
4 pull requests received 10 new comments.
-
Renamed embedded csp header to requires csp w3c/webappsec-csp#218 (6 comments by @mikewest, @wseltzer)
-
w3c/webcrypto
-
3 issues opened.
-
Calling key wrap operation on a JWK encoding w3c/webcrypto#187, by @jimsch.
-
Typo in examples (33.2. Symmetric Encryption) w3c/webcrypto#186, by @arthurgubaidullin.
-
Make CryptoKey interface more specific w3c/webcrypto#185, by @saschanaz.
-
-
1 issue closed.
-
"Asynchronously perform the remaining steps" is not well-defined w3c/webcrypto#168.
-
-
3 issues received 4 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @neckaros)
-
"Asynchronously perform the remaining steps" is not well-defined w3c/webcrypto#168 (1 comment by @plehegar)
-
-
1 pull request merged.
-
in parallel #168 w3c/webcrypto#180.
-
-
1 pull request received 2 new comments.
w3c/webappsec
-
1 issue opened.
-
#CredAPI Signing-Out: maybe user agent MUST provide UI for changing mediation? w3c/webappsec#530, by @yackermann.
-
-
1 issue received 1 new comment.
-
#CredAPI Signing-Out: maybe user agent MUST provide UI for changing mediation? w3c/webappsec#530 (1 comment by @yackermann)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Using FP to support safe pre-rendering w3c/webappsec-permissions-policy#77, by @triblondon.
-
-
3 issues closed.
-
[TAG] Inconsistent terminology between Explainer and Spec w3c/webappsec-permissions-policy#73.
-
[TAG] Inheritance may be unnecessarily confusing w3c/webappsec-permissions-policy#67.
-
[TAG] Inconsistency: enable/disable in explainer but spec only provides enable w3c/webappsec-permissions-policy#72.
-
-
6 issues received 9 new comments.
-
[TAG] Interaction with New Features w3c/webappsec-permissions-policy#69 (2 comments by @clelland, @raymeskhoury)
-
[TAG] Raising error causes w3c/webappsec-permissions-policy#68 (2 comments by @ojanvafai, @raymeskhoury)
-
[TAG] New Registry; Strategy for Updates? w3c/webappsec-permissions-policy#75 (2 comments by @clelland, @raymeskhoury)
-
[TAG] Inconsistent terminology between Explainer and Spec w3c/webappsec-permissions-policy#73 (1 comment by @clelland)
-
[TAG] Inconsistency: enable/disable in explainer but spec only provides enable w3c/webappsec-permissions-policy#72 (1 comment by @clelland)
-
[TAG] Inheritance may be unnecessarily confusing w3c/webappsec-permissions-policy#67 (1 comment by @raymeskhoury)
-
w3c/webappsec-credential-management
-
3 issues opened.
-
expose CredMan api to workers w3c/webappsec-credential-management#87, by @equalsJeffH.
-
Mark all interfaces' attributes [SameObject]. w3c/webappsec-credential-management#85, by @jyasskin.
-
Specify that Promises reject if their global's document is destroyed. w3c/webappsec-credential-management#83, by @jyasskin.
-
-
2 issues closed.
-
Mark all interfaces' attributes [SameObject]. w3c/webappsec-credential-management#85.
-
Expose passwords to JavaScript w3c/webappsec-credential-management#75.
-
-
4 issues received 8 new comments.
-
Specify that Promises reject if their global's document is destroyed. w3c/webappsec-credential-management#83 (4 comments by @annevk, @jyasskin, @mikewest)
-
Consider renaming `requireUserMediation()`. w3c/webappsec-credential-management#74 (2 comments by @battre, @kpaulh)
-
-
3 pull requests opened.
-
Mark all interfaces' attributes [SameObject] w3c/webappsec-credential-management#86, by @battre.
-
Rename requireUserMediation to preventSilentAccess w3c/webappsec-credential-management#84, by @battre.
-
Use pr-review tool w3c/webappsec-credential-management#82, by @plehegar.
-
-
4 pull requests merged.
-
Mark all interfaces' attributes [SameObject] w3c/webappsec-credential-management#86.
-
Rename requireUserMediation to preventSilentAccess w3c/webappsec-credential-management#84.
-
Expose Passwords to JavaScript w3c/webappsec-credential-management#76.
-
Use pr-review tool w3c/webappsec-credential-management#82.
-
-
2 pull requests received 30 new comments.
-
Rename requireUserMediation to preventSilentAccess w3c/webappsec-credential-management#84 (15 comments by @battre, @foolip, @mikewest, @teohhanhui)
-
Expose Passwords to JavaScript w3c/webappsec-credential-management#76 (15 comments by @battre, @jonathanKingston, @mikewest)
-
w3c/webappsec-suborigins
-
4 issues opened.
-
Rename Suborigin request header to Sec-suborigin w3c/webappsec-suborigins#72, by @annevk.
-
Protecting Suborigined content from non-suborigined content w3c/webappsec-suborigins#71, by @adob.
-
Keep the published editors draft in sync with master w3c/webappsec-suborigins#70, by @adob.
-
Remove Unicode serialization of a suborigin w3c/webappsec-suborigins#69, by @annevk.
-
-
5 issues closed.
-
Create a reserved prefix or delimiter for serialization of typed suborigins w3c/webappsec-suborigins#40.
-
Why having both serialized origins and finerorigin/suborigin w3c/webappsec-suborigins#6.
-
Behavior of Host prefix in the presence of unsafe-cookies option w3c/webappsec-suborigins#28.
-
postMessage extra argument for suborigin w3c/webappsec-suborigins#26.
-
Suborigin names should not be allowed to start with number w3c/webappsec-suborigins#47.
-
-
1 issue reopened.
-
Keep the published editors draft in sync with master w3c/webappsec-suborigins#70, by @annevk.
-
-
9 issues received 28 new comments.
-
How to treat localStorage and sessionStorage w3c/webappsec-suborigins#34 (9 comments by @annevk, @arturjanc, @devd, @jeisinger)
-
Keep the published editors draft in sync with master w3c/webappsec-suborigins#70 (6 comments by @annevk, @devd, @domenic)
-
Protecting Suborigined content from non-suborigined content w3c/webappsec-suborigins#71 (4 comments by @adob, @annevk, @devd)
-
document.suborigin or something should allow JS to detect if in suborigin w3c/webappsec-suborigins#35 (3 comments by @devd, @jeisinger)
-
Create a reserved prefix or delimiter for serialization of typed suborigins w3c/webappsec-suborigins#40 (2 comments by @devd, @hillbrad)
-
Why having both serialized origins and finerorigin/suborigin w3c/webappsec-suborigins#6 (1 comment by @devd)
-
Behavior of Host prefix in the presence of unsafe-cookies option w3c/webappsec-suborigins#28 (1 comment by @devd)
-
Suborigin names should not be allowed to start with number w3c/webappsec-suborigins#47 (1 comment by @devd)
-
-
1 pull request opened.
-
Add myself as editor w3c/webappsec-suborigins#68, by @jeisinger.
-
-
2 pull requests merged.
-
Add myself as editor w3c/webappsec-suborigins#68.
-
Sketch for how postMessage / MessageEvent could work w3c/webappsec-suborigins#67.
-
-
2 pull requests received 8 new comments.
-
Add myself as editor w3c/webappsec-suborigins#68 (6 comments by @annevk, @devd, @jeisinger, @wseltzer)
-
Sketch for how postMessage / MessageEvent could work w3c/webappsec-suborigins#67 (2 comments by @devd, @jeisinger)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Creator context security used incorrectly w3c/webappsec-secure-contexts#48, by @annevk.
-
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-secure-contexts#47, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-secure-contexts#47.
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Proposal: Integrity attribute for <link prefetch> w3c/webappsec-subresource-integrity#70, by @guybedford.
-
-
1 issue closed.
-
Proposal: Integrity attribute for <link prefetch> w3c/webappsec-subresource-integrity#70.
-
-
2 issues received 2 new comments.
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26 (1 comment by @guybedford)
-
Proposal: Integrity attribute for <link prefetch> w3c/webappsec-subresource-integrity#70 (1 comment by @guybedford)
-
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-subresource-integrity#69, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-subresource-integrity#69.
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-referrer-policy#104, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-referrer-policy#104.
-
w3c/webappsec-mixed-content
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-mixed-content#9, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-mixed-content#9.
-
w3c/webappsec-upgrade-insecure-requests
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-upgrade-insecure-requests#8, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-upgrade-insecure-requests#8.
-
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-clear-site-data#25, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-clear-site-data#25.
-
w3c/webappsec-cowl
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-cowl#70, by @plehegar.
-
-
1 pull request merged.
-
Use pr-review tool w3c/webappsec-cowl#70.
-
w3c/webappsec-uisecurity
-
1 pull request opened.
-
Use pr-review tool w3c/webappsec-uisecurity#11, by @plehegar.
-
Participants
-
2 participants joined.
-
Josh Soref (W3C Invited Experts) joined.
-
Michael[tm] Smith (sideshowbarker) (W3C) joined.
-
-
8 organizations joined.
-
HUMAN joined.
-
PayPal joined.
-
Digital Bazaar joined.
-
Opera Software AS joined.
-
MITRE Corporation joined.
-
Adobe joined.
-
Meta joined.
-
Intel Corporation joined.
-
GitHub
w3c/permissions
-
2 issues opened.
-
Reflect `fullscreen` state w3c/permissions#145, by @slightlyoff.
-
Spec examples do not include `request()` w3c/permissions#144, by @slightlyoff.
-
-
1 issue closed.
-
Add permission for Accelerometer, Gyroscope, Magnetometer and Orientation Sensor. w3c/permissions#141.
-
-
2 issues received 2 new comments.
-
1 pull request opened.
-
chore(perm interface): Fix return value handling w3c/permissions#143, by @jugglinmike.
-
-
1 pull request merged.
-
Add permission for Accelerometer, Gyroscope, Magnetometer and Orientation Sensor w3c/permissions#142.
-
-
1 pull request received 16 new comments.
-
Add permission for Accelerometer, Gyroscope, Magnetometer and Orientation Sensor w3c/permissions#142 (16 comments by @anssiko, @marcoscaceres, @pozdnyakov, @raymeskhoury, @riju, @tobie)
-
w3c/webappsec-permissions-policy
-
11 issues opened.
-
Confusing "speaker" feature w3c/webappsec-permissions-policy#76, by @AshleyScirra.
-
[TAG] New Registry; Strategy for Updates? w3c/webappsec-permissions-policy#75, by @slightlyoff.
-
[TAG] Unify with `sandbox` attribute? w3c/webappsec-permissions-policy#74, by @slightlyoff.
-
[TAG] Inconsistent terminology between Explainer and Spec w3c/webappsec-permissions-policy#73, by @slightlyoff.
-
[TAG] Inconsistency: enable/disable in explainer but spec only provides enable w3c/webappsec-permissions-policy#72, by @slightlyoff.
-
[TAG] Confusion over extending policy into child frames w3c/webappsec-permissions-policy#71, by @triblondon.
-
[TAG] Inconsistent granularity w3c/webappsec-permissions-policy#70, by @triblondon.
-
[TAG] Interaction with New Features w3c/webappsec-permissions-policy#69, by @slightlyoff.
-
[TAG] Raising error causes w3c/webappsec-permissions-policy#68, by @triblondon.
-
[TAG] Inheritance may be unnecessarily confusing w3c/webappsec-permissions-policy#67, by @triblondon.
-
Expose policy to javascript w3c/webappsec-permissions-policy#65, by @clelland.
-
-
1 issue closed.
-
Normatively reference a definition of "origin" w3c/webappsec-permissions-policy#46.
-
-
11 issues received 15 new comments.
-
eme: Encrypted Media Extensions w3c/webappsec-permissions-policy#40 (4 comments by @clelland, @ddorwin, @LoonyBean)
-
Specify handling of IDN / Unicode chars in origins w3c/webappsec-permissions-policy#51 (2 comments by @clelland, @RByers)
-
[TAG] Confusion over extending policy into child frames w3c/webappsec-permissions-policy#71 (1 comment by @clelland)
-
[TAG] Inheritance may be unnecessarily confusing w3c/webappsec-permissions-policy#67 (1 comment by @clelland)
-
Normatively reference a definition of "origin" w3c/webappsec-permissions-policy#46 (1 comment by @clelland)
-
Delivery section should address new/unrecognized features and directive members w3c/webappsec-permissions-policy#47 (1 comment by @clelland)
-
Microsoft's feedback on Feature Policy spec w3c/webappsec-permissions-policy#62 (1 comment by @raymeskhoury)
-
-
2 pull requests opened.
-
Change "eme" feature to "encrypted-media" w3c/webappsec-permissions-policy#66, by @clelland.
-
Reference origin in allowlist section w3c/webappsec-permissions-policy#64, by @clelland.
-
-
1 pull request merged.
-
Reference origin in allowlist section w3c/webappsec-permissions-policy#64.
-
w3c/webappsec-credential-management
-
7 issues opened.
-
Describe the relationship of our terminology to RFC4949 w3c/webappsec-credential-management#81, by @jyasskin.
-
Organize username handling w3c/webappsec-credential-management#80, by @jyasskin.
-
Add a method to populate forms with credential data w3c/webappsec-credential-management#78, by @battre.
-
Expose passwords to JavaScript w3c/webappsec-credential-management#75, by @battre.
-
Consider renaming `requireUserMediation()`. w3c/webappsec-credential-management#74, by @mikewest.
-
Feature request: Add API for android finger print reader w3c/webappsec-credential-management#71, by @BorntraegerMarc.
-
`credentials` should likely be `[SameObject]` w3c/webappsec-credential-management#70, by @mikewest.
-
-
4 issues closed.
-
Let passwords be "extractable" w3c/webappsec-credential-management#68.
-
Feature request: Add API for android finger print reader w3c/webappsec-credential-management#71.
-
`credentials` should likely be `[SameObject]` w3c/webappsec-credential-management#70.
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec-credential-management#1.
-
-
6 issues received 11 new comments.
-
Expose passwords to JavaScript w3c/webappsec-credential-management#75 (3 comments by @AngeloKai, @battre)
-
Feature request: Add API for android finger print reader w3c/webappsec-credential-management#71 (3 comments by @battre, @BorntraegerMarc)
-
CREDENTIAL: could we make it easier to extend? w3c/webappsec-credential-management#1 (2 comments by @jonathanKingston, @mikewest)
-
Add a method to populate forms with credential data w3c/webappsec-credential-management#78 (1 comment by @vasilii-sv)
-
-
5 pull requests opened.
-
Restore the constructors removed in #72. w3c/webappsec-credential-management#79, by @mikewest.
-
Explain that the credential store records which credentials were "effective". w3c/webappsec-credential-management#77, by @jyasskin.
-
Expose Passwords to JavaScript w3c/webappsec-credential-management#76, by @battre.
-
Replace the 'unmediated' bool with a 'mediation' enum. w3c/webappsec-credential-management#73, by @mikewest.
-
Define a 'create()' method on 'CredentialsContainer'. w3c/webappsec-credential-management#72, by @mikewest.
-
-
4 pull requests merged.
-
Explain that the credential store records which credentials were "effective". w3c/webappsec-credential-management#77.
-
Restore the constructors removed in #72. w3c/webappsec-credential-management#79.
-
Define a 'create()' method on 'CredentialsContainer'. w3c/webappsec-credential-management#72.
-
Replace the 'unmediated' bool with a 'mediation' enum. w3c/webappsec-credential-management#73.
-
-
5 pull requests received 140 new comments.
-
Expose Passwords to JavaScript w3c/webappsec-credential-management#76 (58 comments by @battre, @jdoerrie, @jeisinger, @jonathanKingston, @mikewest, @vasilii-sv)
-
Define a 'create()' method on 'CredentialsContainer'. w3c/webappsec-credential-management#72 (45 comments by @battre, @jyasskin, @mikewest)
-
Replace the 'unmediated' bool with a 'mediation' enum. w3c/webappsec-credential-management#73 (30 comments by @battre, @jyasskin, @mikewest)
-
Explain that the credential store records which credentials were "effective". w3c/webappsec-credential-management#77 (6 comments by @jyasskin, @mikewest)
-
Restore the constructors removed in #72. w3c/webappsec-credential-management#79 (1 comment by @mikewest)
-
w3c/webappsec-csp
-
10 issues opened.
-
Inline style bits are very unclear w3c/webappsec-csp#212, by @bzbarsky.
-
Initialialization of a document's CSP doesn't really make sense in the "local scheme" bit w3c/webappsec-csp#211, by @bzbarsky.
-
Please sort out who's responsible for a srcdoc document's CSP w3c/webappsec-csp#209, by @bzbarsky.
-
Documents are not global objects w3c/webappsec-csp#208, by @bzbarsky.
-
What does it mean to alias a policy from a CSP list? w3c/webappsec-csp#207, by @bzbarsky.
-
Integration with worklets w3c/webappsec-csp#204, by @bfgeek.
-
worklet-src directive needed for worklets? w3c/webappsec-csp#203, by @bfgeek.
-
Consider a style-src keyword to allow style attributes but not <style> elements w3c/webappsec-csp#202, by @arturjanc.
-
clarify whether csp blocks reflection of non-string arguments to eval w3c/webappsec-csp#201, by @jeisinger.
-
'strict-dynamic' should bless programmatically added workers w3c/webappsec-csp#200, by @arturjanc.
-
-
1 issue closed.
-
'strict-dynamic' should bless programmatically added workers w3c/webappsec-csp#200.
-
-
6 issues received 20 new comments.
-
'strict-dynamic' should bless programmatically added workers w3c/webappsec-csp#200 (9 comments by @arturjanc, @dconnolly, @mikewest)
-
Please sort out who's responsible for a srcdoc document's CSP w3c/webappsec-csp#209 (4 comments by @annevk, @bzbarsky, @mikewest)
-
worklet-src directive needed for worklets? w3c/webappsec-csp#203 (3 comments by @annevk, @bfgeek, @mikewest)
-
clarify whether csp blocks reflection of non-string arguments to eval w3c/webappsec-csp#201 (2 comments by @domenic, @mikewest)
-
-
3 pull requests opened.
-
Clean up CSP list initialization. w3c/webappsec-csp#210, by @mikewest.
-
Add a link to web-platform-tests to the top of the spec w3c/webappsec-csp#206, by @foolip.
-
Adds WorkletGlobalScope as a concept to CSP. w3c/webappsec-csp#205, by @bfgeek.
-
-
1 pull request merged.
-
Add a link to web-platform-tests to the top of the spec w3c/webappsec-csp#206.
-
-
3 pull requests received 10 new comments.
-
Clean up CSP list initialization. w3c/webappsec-csp#210 (5 comments by @annevk, @bzbarsky, @mikewest)
-
Adds WorkletGlobalScope as a concept to CSP. w3c/webappsec-csp#205 (4 comments by @annevk, @bfgeek, @mikewest)
-
Add a link to web-platform-tests to the top of the spec w3c/webappsec-csp#206 (1 comment by @mikewest)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Classification of storage types w3c/webappsec-clear-site-data#24, by @annevk.
-
-
1 issue reopened.
-
"cache" feels premature w3c/webappsec-clear-site-data#22, by @slightlyoff.
-
-
2 issues received 6 new comments.
-
"cache" feels premature w3c/webappsec-clear-site-data#22 (5 comments by @annevk, @mikewest, @mnot, @slightlyoff)
-
w3c/webcrypto
-
2 issues opened.
-
HKDF's deriveBits() operation does not convert "length" parameter to octets w3c/webcrypto#184, by @ghost.
-
TypeMismatchError is deprecated w3c/webcrypto#183, by @saschanaz.
-
-
1 issue received 1 new comment.
-
HKDF's deriveBits() operation does not convert "length" parameter to octets w3c/webcrypto#184 (1 comment by @sleevi)
-
w3c/webappsec-suborigins
-
1 issue opened.
-
Remove need for serializing a suborigin w3c/webappsec-suborigins#66, by @jeisinger.
-
-
1 pull request opened.
-
Sketch for how postMessage / MessageEvent could work w3c/webappsec-suborigins#67, by @jeisinger.
-
-
1 pull request received 58 new comments.
-
Sketch for how postMessage / MessageEvent could work w3c/webappsec-suborigins#67 (58 comments by @adob, @annevk, @devd, @jeisinger, @mikewest)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Normative definition of optionally-blockable contradicts following note w3c/webappsec-mixed-content#8, by @bzbarsky.
-
-
1 issue received 3 new comments.
-
Normative definition of optionally-blockable contradicts following note w3c/webappsec-mixed-content#8 (3 comments by @annevk, @bzbarsky, @mikewest)
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Add a link to web-platform-tests to the top of the spec w3c/webappsec-referrer-policy#103, by @foolip.
-
w3c/webappsec-cowl
-
2 issues opened.
-
Tie in with feature policy? w3c/webappsec-cowl#69, by @deian.
-
Chromium implementation tracking w3c/webappsec-cowl#68, by @deian.
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
Lifecycle
-
1 charter started.
-
Chartered until 31 December 2018. Participants had to rejoin under this charter.
-
Participants
-
1 participant joined.
-
Giorgio Maone (W3C Invited Experts) joined.
-
-
8 participants left.
-
Malika Aubakirova (W3C Invited Experts) left.
-
Niklas Andreasson (W3C Invited Experts) left.
-
Xueyuan Jia (W3C) left.
-
Josh Soref (W3C Invited Experts) left.
-
Keiji Takeda (W3C) left.
-
Wendy Seltzer (W3C) left.
-
Giorgio Maone (W3C Invited Experts) left.
-
Michael[tm] Smith (sideshowbarker) (W3C) left.
-
-
5 organizations joined.
-
Yandex joined.
-
Mozilla Foundation joined.
-
Google LLC joined.
-
Dropbox, Inc. joined.
-
OpenJS Foundation joined.
-
-
36 organizations left.
-
AT&T left.
-
China Mobile Communications Corporation left.
-
Opera Software AS left.
-
HUMAN left.
-
China Academy of Information and Communications Technology (CAICT) left.
-
Apple Inc. left.
-
Deutsche Telekom AG left.
-
GitStar left.
-
PayPal left.
-
Copper Horse Solutions Ltd left.
-
Viacom inc. left.
-
Samsung Electronics Co., Ltd. left.
-
imec left.
-
Cable Television Laboratories Inc left.
-
Tencent left.
-
eBay left.
-
Microsoft Corporation left.
-
DigiCert SSL Certificate Authority left.
-
Mitsubishi Electric Corporation left.
-
Verisign, Inc. left.
-
Adobe left.
-
MITRE Corporation left.
-
X left.
-
Dropbox, Inc. left.
-
Pacific Northwest National Laboratory left.
-
Yandex left.
-
Alibaba Group left.
-
Baidu, Inc. left.
-
Electronics and Telecommunications Research Institute (ETRI) left.
-
Digital Bazaar left.
-
Stanford University left.
-
Akamai Technologies left.
-
Google LLC left.
-
Meta left.
-
Mozilla Foundation left.
-
Intel Corporation left.
-
GitHub
w3c/webappsec-credential-management
-
6 issues opened.
-
Let passwords be "extractable" w3c/webappsec-credential-management#68, by @jyasskin.
-
PSL issue: Unify collected credentials w3c/webappsec-credential-management#67, by @battre.
-
PSL issue: only PSL match on unmediated==false w3c/webappsec-credential-management#66, by @battre.
-
origin concept and algorithms w3c/webappsec-credential-management#64, by @equalsJeffH.
-
User agent should/may not allow overriding "store" and "get" w3c/webappsec-credential-management#63, by @meetwudi.
-
Enforce cross sub domain credential sharing w3c/webappsec-credential-management#62, by @meetwudi.
-
-
2 issues closed.
-
origin concept and algorithms w3c/webappsec-credential-management#64.
-
User agent should/may not allow overriding "store" and "get" w3c/webappsec-credential-management#63.
-
-
3 issues received 9 new comments.
-
User agent should/may not allow overriding "store" and "get" w3c/webappsec-credential-management#63 (5 comments by @meetwudi, @mikewest)
-
origin concept and algorithms w3c/webappsec-credential-management#64 (3 comments by @equalsJeffH, @mikewest, @vabr-g)
-
Enforce cross sub domain credential sharing w3c/webappsec-credential-management#62 (1 comment by @mikewest)
-
-
1 pull request opened.
-
Replace RFC6454 references with HTML spec ones w3c/webappsec-credential-management#65, by @vabr-g.
-
-
1 pull request merged.
-
Replace RFC6454 references with HTML spec ones w3c/webappsec-credential-management#65.
-
-
1 pull request received 22 new comments.
-
Replace RFC6454 references with HTML spec ones w3c/webappsec-credential-management#65 (22 comments by @mikewest, @vabr-g)
-
w3c/permissions
-
2 issues opened.
-
Add permission for Accelerometer, Gyroscope, Magnetometer and Orientation Sensor. w3c/permissions#141, by @riju.
-
Add permission for async Clipboard API w3c/permissions#139, by @garykac.
-
-
1 issue closed.
-
Add permission for async Clipboard API w3c/permissions#139.
-
-
1 issue received 2 new comments.
-
3 pull requests opened.
-
Add permission for Accelerometer, Gyroscope, Magnetometer and Orientation Sensor w3c/permissions#142, by @riju.
-
Fix #139 - Add 'clipboard' permission w3c/permissions#140, by @garykac.
-
Add permission for Ambient Light Sensor. w3c/permissions#138, by @tobie.
-
-
2 pull requests merged.
-
Fix #139 - Add 'clipboard' permission w3c/permissions#140.
-
Add permission for Ambient Light Sensor. w3c/permissions#138.
-
-
4 pull requests received 12 new comments.
-
Add permission for Accelerometer, Gyroscope, Magnetometer and Orientation Sensor w3c/permissions#142 (4 comments by @anssiko, @riju, @tobie)
-
Add permission for Ambient Light Sensor. w3c/permissions#138 (3 comments by @anssiko, @raymeskhoury)
-
Define restrictions on "device-info" permission (from TPAC). w3c/permissions#131 (3 comments by @fluffy, @marcoscaceres, @stefhak)
-
w3c/webappsec-permissions-policy
-
4 issues opened.
-
Microsoft's feedback on Feature Policy spec w3c/webappsec-permissions-policy#62, by @nolanlawson.
-
Spec needs privacy and security section w3c/webappsec-permissions-policy#61, by @clelland.
-
Feature vs W3C Process term w3c/webappsec-permissions-policy#60, by @nigelmegitt.
-
How vibrate will work with Feature Policy given the user gesture requirement? w3c/webappsec-permissions-policy#58, by @lubin2010.
-
-
5 issues closed.
-
Feature vs W3C Process term w3c/webappsec-permissions-policy#60.
-
Add permission-features to feature policy w3c/webappsec-permissions-policy#52.
-
eme: Encrypted Media Extensions w3c/webappsec-permissions-policy#40.
-
Error handling while parsing policy strings w3c/webappsec-permissions-policy#39.
-
How should iframe navigations work? w3c/webappsec-permissions-policy#38.
-
-
8 issues received 24 new comments.
-
Feature vs W3C Process term w3c/webappsec-permissions-policy#60 (8 comments by @clelland, @nigelmegitt, @zcorpan)
-
How vibrate will work with Feature Policy given the user gesture requirement? w3c/webappsec-permissions-policy#58 (8 comments by @clelland, @jyasskin, @ojanvafai, @raymeskhoury, @VicenteDiaz)
-
Microsoft's feedback on Feature Policy spec w3c/webappsec-permissions-policy#62 (2 comments by @nolanlawson, @zcorpan)
-
eme: Encrypted Media Extensions w3c/webappsec-permissions-policy#40 (2 comments by @clelland, @ddorwin)
-
The implications of the default disable/enable policy are unclear w3c/webappsec-permissions-policy#48 (1 comment by @clelland)
-
Add permission-features to feature policy w3c/webappsec-permissions-policy#52 (1 comment by @clelland)
-
Error handling while parsing policy strings w3c/webappsec-permissions-policy#39 (1 comment by @clelland)
-
-
4 pull requests opened.
-
Rename potentially ambiguous term "Feature" w3c/webappsec-permissions-policy#63, by @clelland.
-
Add filled-out security and privacy questionnaire for TAG review w3c/webappsec-permissions-policy#59, by @clelland.
-
Tighten up definitions and algorithms w3c/webappsec-permissions-policy#57, by @clelland.
-
Update spec editor and README.md w3c/webappsec-permissions-policy#56, by @clelland.
-
-
4 pull requests merged.
-
Rename potentially ambiguous term "Feature" w3c/webappsec-permissions-policy#63.
-
Tighten up definitions and algorithms w3c/webappsec-permissions-policy#57.
-
Add filled-out security and privacy questionnaire for TAG review w3c/webappsec-permissions-policy#59.
-
Update spec editor and README.md w3c/webappsec-permissions-policy#56.
-
-
2 pull requests received 3 new comments.
-
Rename potentially ambiguous term "Feature" w3c/webappsec-permissions-policy#63 (2 comments by @clelland, @zcorpan)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Fetch concept-header-parse reference is out of date w3c/webappsec-referrer-policy#98, by @estark37.
-
-
4 issues closed.
-
The CSS declaration block bit in the draft doesn't make sense w3c/webappsec-referrer-policy#89.
-
what should the referer header be for a fetch() from a blob: URL worker script? w3c/webappsec-referrer-policy#95.
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#81.
-
Fetch concept-header-parse reference is out of date w3c/webappsec-referrer-policy#98.
-
-
4 issues received 8 new comments.
-
Please clarify if header value should be enclosed in quotes or not w3c/webappsec-referrer-policy#97 (3 comments by @Elchi3, @estark37, @polomsky)
-
what should the referer header be for a fetch() from a blob: URL worker script? w3c/webappsec-referrer-policy#95 (2 comments by @jeisinger)
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#81 (2 comments by @annevk, @justin-morgan)
-
Fetch concept-header-parse reference is out of date w3c/webappsec-referrer-policy#98 (1 comment by @annevk)
-
-
4 pull requests opened.
-
Relax ABNF for invalid policy tokens w3c/webappsec-referrer-policy#102, by @estark37.
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#101, by @estark37.
-
Editorial: reference origin terms from the HTML Standard w3c/webappsec-referrer-policy#100, by @annevk.
-
Editorial: use new extracting header list values hook from Fetch w3c/webappsec-referrer-policy#99, by @annevk.
-
-
5 pull requests merged.
-
Clarify referrer rules for inline styles w3c/webappsec-referrer-policy#92.
-
Relax ABNF for invalid policy tokens w3c/webappsec-referrer-policy#102.
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#101.
-
Editorial: reference origin terms from the HTML Standard w3c/webappsec-referrer-policy#100.
-
Editorial: use new extracting header list values hook from Fetch w3c/webappsec-referrer-policy#99.
-
-
5 pull requests received 26 new comments.
-
Relax ABNF for invalid policy tokens w3c/webappsec-referrer-policy#102 (16 comments by @annevk, @estark37, @mikewest)
-
Clarify referrer rules for inline styles w3c/webappsec-referrer-policy#92 (3 comments by @jeisinger, @tabatkins)
-
Add an example for multiple Referrer-Policy headers w3c/webappsec-referrer-policy#101 (3 comments by @domenic, @estark37)
-
Editorial: reference origin terms from the HTML Standard w3c/webappsec-referrer-policy#100 (2 comments by @annevk, @estark37)
-
Editorial: use new extracting header list values hook from Fetch w3c/webappsec-referrer-policy#99 (2 comments by @estark37)
-
w3c/webcrypto
-
2 issues opened.
-
SHA use of "section 6.1" should add "of [FIPS PUB 180-4]" w3c/webcrypto#182, by @jyasskin.
-
Will this spec accept a pull request? w3c/webcrypto#181, by @domenic.
-
-
2 issues received 11 new comments.
-
Will this spec accept a pull request? w3c/webcrypto#181 (9 comments by @domenic, @mwatson2, @plehegar, @sleevi)
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (2 comments by @ericmackrodt, @roccomuso)
-
-
1 pull request opened.
-
in parallel #168 w3c/webcrypto#180, by @plehegar.
-
-
1 pull request received 2 new comments.
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
integrity for downloads w3c/webappsec-subresource-integrity#68, by @dveditz.
-
Getting jQuery Integrity attribute issue w3c/webappsec-subresource-integrity#67, by @Narasimha969.
-
-
1 issue closed.
-
Getting jQuery Integrity attribute issue w3c/webappsec-subresource-integrity#67.
-
-
3 issues received 17 new comments.
-
integrity for downloads w3c/webappsec-subresource-integrity#68 (8 comments by @annevk, @mikewest, @shekyan)
-
Getting jQuery Integrity attribute issue w3c/webappsec-subresource-integrity#67 (1 comment by @mozfreddyb)
-
w3c/webappsec-csp
-
10 issues opened.
-
CSP3: Consider adding a 'clone-src' directive w3c/webappsec-csp#199, by @jwatt.
-
CSP3: Consider adding a 'resource-src' directive w3c/webappsec-csp#198, by @jwatt.
-
Include `script-sample' for "eval" violations w3c/webappsec-csp#197, by @arturjanc.
-
"Does request violate policy" algorithm 6.6.1.1 doesn't accumulate violated directives w3c/webappsec-csp#195, by @chaals.
-
The `disown-opener` directive is not the right model w3c/webappsec-csp#194, by @jwatt.
-
CSP3: Note that the `disown-opener` directive needs to be sent in the HTTP headers w3c/webappsec-csp#193, by @jwatt.
-
image-src in 6.6.1.11 w3c/webappsec-csp#192, by @marcin-gryszkalis.
-
Add keyword to prevent parser-based JS APIs from adding new scripts w3c/webappsec-csp#191, by @arturjanc.
-
CSP3: handling paths for redirected targets will be safe again w3c/webappsec-csp#190, by @ghost.
-
Add ability to specify the version of used CSP w3c/webappsec-csp#189, by @oxdef.
-
-
5 issues closed.
-
CSP Level 2 Headache w3c/webappsec-csp#187.
-
image-src in 6.6.1.11 w3c/webappsec-csp#192.
-
Clarify worker-src goals w3c/webappsec-csp#146.
-
CSP: Identify enforced or report only policy in JSON w3c/webappsec-csp#4.
-
`frame-ancestors` and `x-frame-options` w3c/webappsec-csp#182.
-
-
9 issues received 34 new comments.
-
Allow "inline" violation reports to contain the text of offending scripts w3c/webappsec-csp#119 (13 comments by @arturjanc, @dveditz, @lweichselbaum, @mikewest, @mozfreddyb)
-
CSP3: Consider adding a 'clone-src' directive w3c/webappsec-csp#199 (7 comments by @annevk, @michaelficarra, @mikewest, @mozfreddyb)
-
Add keyword to prevent parser-based JS APIs from adding new scripts w3c/webappsec-csp#191 (4 comments by @annevk, @arturjanc)
-
CSP3: handling paths for redirected targets will be safe again w3c/webappsec-csp#190 (2 comments by @annevk, @mikewest)
-
CSP: Identify enforced or report only policy in JSON w3c/webappsec-csp#4 (2 comments by @mikewest, @ScottHelme)
-
-
1 pull request opened.
-
Make algo 6.6.1.1 accumulate violated directives w3c/webappsec-csp#196, by @chaals.
-
-
1 pull request received 7 new comments.
-
Make algo 6.6.1.1 accumulate violated directives w3c/webappsec-csp#196 (7 comments by @annevk, @chaals, @mikewest)
-
w3c/webappsec-clear-site-data
-
6 issues opened.
-
Rename "executionContexts" w3c/webappsec-clear-site-data#23, by @mikewest.
-
"cache" feels premature w3c/webappsec-clear-site-data#22, by @annevk.
-
storage.clear("executionContexts") ends up doing a reload across tabs w3c/webappsec-clear-site-data#21, by @annevk.
-
Merge with Storage w3c/webappsec-clear-site-data#20, by @annevk.
-
Reference URL Standard w3c/webappsec-clear-site-data#19, by @annevk.
-
canonicalized as per Section 5.1.2 of [RFC6265] w3c/webappsec-clear-site-data#18, by @annevk.
-
-
4 issues closed.
-
storage.clear("executionContexts") ends up doing a reload across tabs w3c/webappsec-clear-site-data#21.
-
canonicalized as per Section 5.1.2 of [RFC6265] w3c/webappsec-clear-site-data#18.
-
Reference URL Standard w3c/webappsec-clear-site-data#19.
-
Service workers w3c/webappsec-clear-site-data#1.
-
-
7 issues received 25 new comments.
-
storage.clear("executionContexts") ends up doing a reload across tabs w3c/webappsec-clear-site-data#21 (5 comments by @annevk, @mikewest)
-
Deal with TLS client certificates and HTTP authentication w3c/webappsec-clear-site-data#2 (5 comments by @annevk, @mikewest)
-
canonicalized as per Section 5.1.2 of [RFC6265] w3c/webappsec-clear-site-data#18 (1 comment by @mikewest)
-
1 pull request opened.
-
No JSON in header value w3c/webappsec-clear-site-data#17, by @msramek.
-
-
2 pull requests merged.
-
Improve the clear-cookies/clear-dom sections. w3c/webappsec-clear-site-data#15.
-
No JSON in header value w3c/webappsec-clear-site-data#17.
-
-
2 pull requests closed.
-
Link section 3.3. to the clear() API. w3c/webappsec-clear-site-data#11.
-
Fixed typo in name of header. w3c/webappsec-clear-site-data#16.
-
-
4 pull requests received 31 new comments.
-
No JSON in header value w3c/webappsec-clear-site-data#17 (16 comments by @annevk, @mikewest, @msramek)
-
Improve the clear-cookies/clear-dom sections. w3c/webappsec-clear-site-data#15 (11 comments by @mikewest, @msramek)
-
Link section 3.3. to the clear() API. w3c/webappsec-clear-site-data#11 (3 comments by @mikewest, @msramek)
-
w3c/webappsec
-
1 issue opened.
-
CSP3: Provide a mechanism to override previous directives w3c/webappsec#528, by @jwatt.
-
-
1 issue closed.
-
CSP3: Provide a mechanism to override previous directives w3c/webappsec#528.
-
-
1 issue received 3 new comments.
-
CSP3: Provide a mechanism to override previous directives w3c/webappsec#528 (3 comments by @annevk, @jwatt)
-
-
1 pull request opened.
-
Recommendations from charter review w3c/webappsec#529, by @wseltzer.
-
-
1 pull request merged.
-
Recommendations from charter review w3c/webappsec#529.
-
w3c/webappsec-secure-contexts
-
1 issue received 2 new comments.
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42 (2 comments by @jwatt, @mnoorenberghe)
-
GitHub
w3c/webappsec-subresource-integrity
-
2 issues opened.
-
Integrity for service workers w3c/webappsec-subresource-integrity#66, by @hlandau.
-
"Apply algorithm to response" is recursive with no base case w3c/webappsec-subresource-integrity#63, by @jyasskin.
-
-
1 issue closed.
-
Mysterious "element:" at top of spec w3c/webappsec-subresource-integrity#61.
-
-
2 issues received 9 new comments.
-
Extend SRI to apply to <link rel=preload> w3c/webappsec-subresource-integrity#26 (5 comments by @annevk, @mikewest, @shekyan, @yoavweiss)
-
"Apply algorithm to response" is recursive with no base case w3c/webappsec-subresource-integrity#63 (4 comments by @fmarier, @jyasskin, @mozfreddyb)
-
-
2 pull requests opened.
-
Be clearer about the "parse metadata" algorithm. w3c/webappsec-subresource-integrity#65, by @jyasskin.
-
Fix #61: escape a <meta> tag. w3c/webappsec-subresource-integrity#64, by @jyasskin.
-
-
2 pull requests merged.
-
Fix #61: escape a <meta> tag. w3c/webappsec-subresource-integrity#64.
-
Be clearer about the "parse metadata" algorithm. w3c/webappsec-subresource-integrity#65.
-
-
1 pull request received 4 new comments.
-
Be clearer about the "parse metadata" algorithm. w3c/webappsec-subresource-integrity#65 (4 comments by @fmarier, @jyasskin, @mozfreddyb)
-
w3c/webappsec-referrer-policy
-
4 issues opened.
-
Please clarify if header value should be enclosed in quotes or not w3c/webappsec-referrer-policy#97, by @polomsky.
-
Why no referrerpolicy="" on <script>? w3c/webappsec-referrer-policy#96, by @domenic.
-
what should the referer header be for a fetch() from a blob: URL worker script? w3c/webappsec-referrer-policy#95, by @wanderview.
-
Add referrer policy `origin-when-downgrade` w3c/webappsec-referrer-policy#94, by @pulzarraider.
-
-
3 issues received 17 new comments.
-
what should the referer header be for a fetch() from a blob: URL worker script? w3c/webappsec-referrer-policy#95 (9 comments by @annevk, @jeisinger, @mikewest, @wanderview)
-
Add referrer policy `origin-when-downgrade` w3c/webappsec-referrer-policy#94 (7 comments by @estark37, @pulzarraider)
-
-
1 pull request received 2 new comments.
-
Clarify referrer rules for inline styles w3c/webappsec-referrer-policy#92 (2 comments by @jdm, @jeisinger)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55, by @clelland.
-
Add permission-features to feature policy w3c/webappsec-permissions-policy#52, by @raymeskhoury.
-
-
1 issue received 2 new comments.
-
Support for declaring feature policy in HTML w3c/webappsec-permissions-policy#55 (2 comments by @clelland, @zcorpan)
-
-
2 pull requests opened.
-
Major update to spec; rewrite in bikeshed. w3c/webappsec-permissions-policy#54, by @clelland.
-
Update spec w3c/webappsec-permissions-policy#53, by @clelland.
-
-
1 pull request merged.
-
Major update to spec; rewrite in bikeshed. w3c/webappsec-permissions-policy#54.
-
-
1 pull request closed.
-
Update spec w3c/webappsec-permissions-policy#53.
-
-
2 pull requests received 15 new comments.
-
Major update to spec; rewrite in bikeshed. w3c/webappsec-permissions-policy#54 (12 comments by @clelland, @igrigorik, @zcorpan)
-
w3c/webappsec-suborigins
-
1 issue opened.
-
same-physical-origin not defined for opaque origins w3c/webappsec-suborigins#65, by @clelland.
-
-
1 issue received 2 new comments.
-
same-physical-origin not defined for opaque origins w3c/webappsec-suborigins#65 (2 comments by @clelland, @devd)
-
w3c/permissions
-
1 issue opened.
-
May reorder the permission state read steps w3c/permissions#137, by @zakorgy.
-
-
1 issue received 1 new comment.
-
1 pull request received 3 new comments.
-
Define restrictions on "device-info" permission (from TPAC). w3c/permissions#131 (3 comments by @jan-ivar, @stefhak)
-
w3c/webappsec-csp
-
7 issues opened.
-
Matching base64 values (hashes and nonces). w3c/webappsec-csp#188, by @slaweg.
-
CSP Level 2 Headache w3c/webappsec-csp#187, by @ghost.
-
Add <base target="x" /> to CSP w3c/webappsec-csp#186, by @craigfrancis.
-
"fetch" is not a valid request initiator value w3c/webappsec-csp#185, by @bzbarsky.
-
Add onsecuritypolicyviolation to the spec w3c/webappsec-csp#184, by @LoonyBean.
-
`frame-ancestors` and `x-frame-options` w3c/webappsec-csp#182, by @mikewest.
-
Potential problem with CSP reporting w3c/webappsec-csp#181, by @nico3333fr.
-
-
2 issues closed.
-
Inline scripting violation: add a script-sample property to the report payload w3c/webappsec-csp#81.
-
"fetch" is not a valid request initiator value w3c/webappsec-csp#185.
-
-
1 issue reopened.
-
Add <base target="x" /> to CSP w3c/webappsec-csp#186, by @craigfrancis.
-
-
13 issues received 43 new comments.
-
Allow dynamically enabling/disabling unsafe-eval w3c/webappsec-csp#87 (12 comments by @annevk, @devd, @mikesherov, @mikewest)
-
Allow "inline" violation reports to contain the text of offending scripts w3c/webappsec-csp#119 (11 comments by @devd, @jacobbednarz, @mikewest, @ScottHelme, @shekyan)
-
`frame-ancestors` and `x-frame-options` w3c/webappsec-csp#182 (4 comments by @annevk, @dveditz, @mikewest)
-
Add <base target="x" /> to CSP w3c/webappsec-csp#186 (3 comments by @annevk, @craigfrancis, @mozfreddyb)
-
Add onsecuritypolicyviolation to the spec w3c/webappsec-csp#184 (3 comments by @LoonyBean, @shekyan, @zcorpan)
-
Prevent nonce stealing by looking for "<script" in attributes of nonced scripts w3c/webappsec-csp#98 (2 comments by @mikewest, @zcorpan)
-
Inline scripting violation: add a script-sample property to the report payload w3c/webappsec-csp#81 (1 comment by @mikewest)
-
Specify browser behavior for CSP headers on 304 (not modified) responses w3c/webappsec-csp#161 (1 comment by @mnot)
-
-
1 pull request opened.
-
Fixes "Does path A match path B?" w3c/webappsec-csp#183, by @shekyan.
-
-
1 pull request merged.
-
typo correction w3c/webappsec-csp#178.
-
-
2 pull requests received 3 new comments.
w3c/webcrypto
-
3 issues opened.
-
Use [SameObject] for the crypto attribute w3c/webcrypto#179, by @foolip.
-
Supported operation list missing "digest" w3c/webcrypto#178, by @jyasskin.
-
AES-CBC decryption should not throw error while dealing with bad padded ciphers w3c/webcrypto#177, by @alanwaketan.
-
-
1 issue received 1 new comment.
-
2 pull requests closed.
-
Update Overview-WebCryptoAPI.xml w3c/webcrypto#171.
-
Fix #165: Add note directing future proposals to WICG w3c/webcrypto#166.
-
-
1 pull request received 1 new comment.
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Add CORS guidance to specification w3c/webappsec-upgrade-insecure-requests#7, by @BigBlueHat.
-
-
2 issues closed.
-
Add CORS guidance to specification w3c/webappsec-upgrade-insecure-requests#7.
-
121 w3c/webappsec-upgrade-insecure-requests#6.
-
-
1 issue received 21 new comments.
-
Add CORS guidance to specification w3c/webappsec-upgrade-insecure-requests#7 (21 comments by @annevk, @BigBlueHat, @davidlehn, @mikewest)
-
w3c/webappsec-secure-contexts
-
1 issue closed.
-
Allow "localhost" as long as it actually resolves to a localhost address w3c/webappsec-secure-contexts#43.
-
-
1 issue received 1 new comment.
-
Allow "localhost" as long as it actually resolves to a localhost address w3c/webappsec-secure-contexts#43 (1 comment by @mikewest)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
Security Considerations section should contain additional guidance w3c/webappsec-credential-management#58, by @vabr-g.
-
Get APA review before CR w3c/webappsec-credential-management#57, by @wseltzer.
-
-
2 issues closed.
-
Documentation for `unmediated` option unclear w3c/webappsec-credential-management#20.
-
PasswordCredential(HTMLFormElement form) may fail in valid password change form cases w3c/webappsec-credential-management#34.
-
-
1 issue received 1 new comment.
-
should incumbent settings object be relevant settings object? w3c/webappsec-credential-management#53 (1 comment by @battre)
-
-
3 pull requests opened.
-
Fix PasswordCredential(form) constructor for password change forms w3c/webappsec-credential-management#61, by @battre.
-
Introduce bad() to deal with expired credentials w3c/webappsec-credential-management#60, by @battre.
-
Permit silently storing PSL matched credentials w3c/webappsec-credential-management#59, by @battre.
-
-
3 pull requests merged.
-
Issue 20: Clarify unmediated get w3c/webappsec-credential-management#45.
-
Instruct to call store() after get() w3c/webappsec-credential-management#37.
-
Fix PasswordCredential(form) constructor for password change forms w3c/webappsec-credential-management#61.
-
-
6 pull requests received 25 new comments.
-
Fix PasswordCredential(form) constructor for password change forms w3c/webappsec-credential-management#61 (9 comments by @battre, @mikewest)
-
Introduce bad() to deal with expired credentials w3c/webappsec-credential-management#60 (6 comments by @battre, @mikewest)
-
Permit silently storing PSL matched credentials w3c/webappsec-credential-management#59 (4 comments by @mikewest)
-
Update 'Extract body' algorithm to fit in the latest Fetch spec w3c/webappsec-credential-management#50 (4 comments by @mikewest)
-
Note that a UA may create a new credential from the selection UI w3c/webappsec-credential-management#44 (1 comment by @mikewest)
-
w3c/webappsec-cors-for-developers
-
1 pull request opened.
-
s/gretting/greeting/ w3c/webappsec-cors-for-developers#8, by @haywhisksoftware.
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
-
Deal with TLS client certificates and HTTP authentication w3c/webappsec-clear-site-data#2 (1 comment by @Foxyroxy1)
-
-
1 pull request opened.
-
Fixed typo in name of header. w3c/webappsec-clear-site-data#16, by @ScottHelme.
-
-
1 pull request received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
Clear-Site-Data header, typo in spec w3c/webappsec#527, by @ScottHelme.
-
-
1 issue closed.
-
Clear-Site-Data header, typo in spec w3c/webappsec#527.
-
-
2 issues received 6 new comments.
-
HPKP: Set Content-Type header field in reports w3c/webappsec#526 (4 comments by @annevk, @mikewest, @mnot)
-
w3c/webappsec-cowl
-
1 issue opened.
-
Get APA review before CR w3c/webappsec-cowl#67, by @wseltzer.
-
TR publications
-
1 document published.
-
Referrer Policy published as a Candidate Recommendation Snapshot. History of Referrer Policy
-
GitHub
w3c/webcrypto
-
7 issues opened.
-
ECC-based encryption? w3c/webcrypto#176, by @yaronf.
-
ECC: validating group membership w3c/webcrypto#175, by @yaronf.
-
Recommending GCM for interoperability w3c/webcrypto#174, by @yaronf.
-
Decryption errors w3c/webcrypto#173, by @yaronf.
-
Rarely implemented primitives, and HKDF details w3c/webcrypto#172, by @yaronf.
-
Do not mandate secure context for SubtleCrypto w3c/webcrypto#170, by @andrewmd5.
-
Should window.crypto be specified to be non-configurable and non-writable? w3c/webcrypto#169, by @srikumarks.
-
-
3 issues closed.
-
Rarely implemented primitives, and HKDF details w3c/webcrypto#172.
-
Decryption errors w3c/webcrypto#173.
-
ECC: validating group membership w3c/webcrypto#175.
-
-
2 issues reopened.
-
ECC-based encryption? w3c/webcrypto#176, by @jimsch.
-
Do not mandate secure context for SubtleCrypto w3c/webcrypto#170, by @andrewmd5.
-
-
5 issues received 13 new comments.
-
1 pull request opened.
-
Update Overview-WebCryptoAPI.xml w3c/webcrypto#171, by @dnhn.
-
w3c/webappsec-referrer-policy
-
2 issues closed.
-
redact location.ancestorOrigins according to Referrer Policy w3c/webappsec-referrer-policy#71.
-
Where does a "block" come from in the sheet-with-null-location case? w3c/webappsec-referrer-policy#90.
-
-
3 issues received 15 new comments.
-
The CSS declaration block bit in the draft doesn't make sense w3c/webappsec-referrer-policy#89 (11 comments by @annevk, @bzbarsky, @jeisinger)
-
redact location.ancestorOrigins according to Referrer Policy w3c/webappsec-referrer-policy#71 (3 comments by @annevk, @jeisinger, @wseltzer)
-
Where does a "block" come from in the sheet-with-null-location case? w3c/webappsec-referrer-policy#90 (1 comment by @jeisinger)
-
-
3 pull requests opened.
-
Update CR copy w3c/webappsec-referrer-policy#93, by @jeisinger.
-
Clarify referrer rules for inline styles w3c/webappsec-referrer-policy#92, by @jeisinger.
-
Fix typo in css integration (closes #90) w3c/webappsec-referrer-policy#91, by @jeisinger.
-
-
2 pull requests merged.
-
Update CR copy w3c/webappsec-referrer-policy#93.
-
Fix typo in css integration (closes #90) w3c/webappsec-referrer-policy#91.
-
-
1 pull request received 1 new comment.
w3c/webappsec-cors-for-developers
-
1 pull request opened.
-
two minor nits w3c/webappsec-cors-for-developers#7, by @oreoshake.
-
w3c/permissions
-
2 issues opened.
-
Maybe add navigator.permissions.supports()? w3c/permissions#136, by @marcoscaceres.
-
Permission query algorithm should be able to fail w3c/permissions#135, by @jyasskin.
-
-
1 issue received 2 new comments.
-
Permission query algorithm should be able to fail w3c/permissions#135 (2 comments by @jyasskin, @marcoscaceres)
-
w3c/webappsec
-
2 issues opened.
-
HPKP: Set Content-Type header field in reports w3c/webappsec#526, by @ScottHelme.
-
[upgrade-insecure-requests] doc reference to wrong document w3c/webappsec#525, by @elinesterov.
-
w3c/webappsec-csp
-
6 issues opened.
-
Add a warning in the spec about the importance of base-uri for nonce-based policies w3c/webappsec-csp#177, by @arturjanc.
-
"http://*:80" is a valid source-expression but doesn't match "http://example.com:80" w3c/webappsec-csp#176, by @ArthurSonzogni.
-
Stricter attribute parsing w3c/webappsec-csp#175, by @craigfrancis.
-
Policy to allow only custom properties in inline CSS w3c/webappsec-csp#174, by @J0WI.
-
Spec refers to "subresource" Fetch destination w3c/webappsec-csp#172, by @yoavweiss.
-
"Does path A match path B?" is incorrect w3c/webappsec-csp#171, by @shekyan.
-
-
1 issue closed.
-
"http://*:80" is a valid source-expression but doesn't match "http://example.com:80" w3c/webappsec-csp#176.
-
-
3 issues received 8 new comments.
-
Policy to allow only custom properties in inline CSS w3c/webappsec-csp#174 (5 comments by @J0WI, @mikewest, @mozfreddyb)
-
"http://*:80" is a valid source-expression but doesn't match "http://example.com:80" w3c/webappsec-csp#176 (2 comments by @ArthurSonzogni, @shekyan)
-
-
4 pull requests opened.
-
EE: Similarity of two source expressions w3c/webappsec-csp#180, by @aubakirova.
-
EE: Fixing spaces w3c/webappsec-csp#179, by @aubakirova.
-
typo correction w3c/webappsec-csp#178, by @snf.
-
Update link/title for reporting spec w3c/webappsec-csp#173, by @RByers.
-
-
1 pull request merged.
-
Update link/title for reporting spec w3c/webappsec-csp#173.
-
-
1 pull request closed.
-
EE: Subsumption algorithm w3c/webappsec-csp#170.
-
-
3 pull requests received 4 new comments.
w3c/webappsec-credential-management
-
5 issues opened.
-
Support deleting credentials. w3c/webappsec-credential-management#56, by @battre.
-
Please do not use "incumbent" w3c/webappsec-credential-management#54, by @domenic.
-
should incumbent settings object be relevant settings object? w3c/webappsec-credential-management#53, by @equalsJeffH.
-
`[SecureContext]` IDL extended attribute not used? w3c/webappsec-credential-management#52, by @equalsJeffH.
-
PasswordCredential(HTMLFormElement form) may destroy data on updating credentials w3c/webappsec-credential-management#51, by @battre.
-
-
4 issues closed.
-
`[SecureContext]` IDL extended attribute not used? w3c/webappsec-credential-management#52.
-
Please do not use "incumbent" w3c/webappsec-credential-management#54.
-
Fix bikeshed warnings w3c/webappsec-credential-management#39.
-
Clarify storage of a SiteBoundCredential w3c/webappsec-credential-management#28.
-
-
5 issues received 7 new comments.
-
PasswordCredential(HTMLFormElement form) may destroy data on updating credentials w3c/webappsec-credential-management#51 (3 comments by @battre, @vabr-g)
-
Support deleting credentials. w3c/webappsec-credential-management#56 (1 comment by @ithinkihaveacat)
-
should incumbent settings object be relevant settings object? w3c/webappsec-credential-management#53 (1 comment by @domenic)
-
-
1 pull request opened.
-
Use [SecureContext] on interfaces w3c/webappsec-credential-management#55, by @battre.
-
-
2 pull requests merged.
-
Use [SecureContext] on interfaces w3c/webappsec-credential-management#55.
-
Issue 28: Clarify storing credentials w3c/webappsec-credential-management#46.
-
-
5 pull requests received 14 new comments.
-
additionalData should handle generic objects w3c/webappsec-credential-management#48 (2 comments by @tobie, @vabr-g)
-
Issue 28: Clarify storing credentials w3c/webappsec-credential-management#46 (2 comments by @battre)
-
Note that a UA may create a new credential from the selection UI w3c/webappsec-credential-management#44 (1 comment by @battre)
w3c/webappsec-suborigins
-
1 issue opened.
-
Use path prefixes instead? w3c/webappsec-suborigins#64, by @hlandau.
-
-
1 issue received 2 new comments.
w3c/webappsec-secure-contexts
-
1 issue received 2 new comments.
-
Should opener be taken into consideration when determining if a context is secure? w3c/webappsec-secure-contexts#42 (2 comments by @dveditz, @mikewest)
-
w3c/webappsec-subresource-integrity
-
1 issue received 2 new comments.