Web Application Security Working Group - Activity in 2020
No matches.
Participants
-
1 participant joined.
-
Daniel Fishkov (RingCentral) joined.
-
-
2 organizations joined.
-
The Washington Post joined.
-
RingCentral joined.
-
GitHub
w3c/webappsec
-
1 issue received 1 new comment.
w3c/webappsec-csp
-
3 issues opened.
-
CSP rules from an external URL? w3c/webappsec-csp#453, by @yonixw.
-
Do column numbers in violation reports start with 0 or 1? w3c/webappsec-csp#452, by @antosart.
-
Invalid hash in example of section 7.15.2 Hash usage for script elements w3c/webappsec-csp#451, by @claesenm.
-
-
1 issue closed.
-
Invalid hash in example of section 7.15.2 Hash usage for script elements w3c/webappsec-csp#451.
-
-
3 issues received 6 new comments.
-
Do column numbers in violation reports start with 0 or 1? w3c/webappsec-csp#452 (1 comment by @annevk)
-
Invalid hash in example of section 7.15.2 Hash usage for script elements w3c/webappsec-csp#451 (1 comment by @claesenm)
-
1 pull request received 2 new comments.
w3c/permissions
-
1 issue closed.
-
Publish new WD to /TR? w3c/permissions#215.
-
-
1 issue received 2 new comments.
-
2 pull requests opened.
-
Expose PermissionName as IDL w3c/permissions#229, by @saschanaz.
-
Remove clipboard-read from PermissionName w3c/permissions#228, by @saschanaz.
-
w3c/webappsec-referrer-policy
-
1 pull request opened.
-
Correct example 16 now that default has changed w3c/webappsec-referrer-policy#144, by @ericlaw1979.
-
-
1 pull request merged.
-
Correct example 16 now that default has changed w3c/webappsec-referrer-policy#144.
-
-
2 pull requests received 8 new comments.
-
Make 'unsafe-url' an alias for 'no-referrer-when-downgrade' w3c/webappsec-referrer-policy#124 (5 comments by @annevk, @ericlaw1979, @krgovind, @mikewest)
-
Correct example 16 now that default has changed w3c/webappsec-referrer-policy#144 (3 comments by @domenic, @ericlaw1979, @w3cbot)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
https://github.com/rferreiraf/BotCasino.git w3c/webappsec-permissions-policy#415, by @theblue888.
-
Proposal: Transition 'document-domain' feature to Document Policy w3c/webappsec-permissions-policy#414, by @theblue888.
-
-
3 issues closed.
-
Move Document Policy w3c/webappsec-permissions-policy#411.
-
https://github.com/rferreiraf/BotCasino.git w3c/webappsec-permissions-policy#415.
-
Support for disabled by default features? w3c/webappsec-permissions-policy#412.
-
-
3 issues received 6 new comments.
-
Proposal: Transition 'document-domain' feature to Document Policy w3c/webappsec-permissions-policy#414 (3 comments by @annevk, @clelland, @mikewest)
-
Support for disabled by default features? w3c/webappsec-permissions-policy#412 (2 comments by @acomminos, @annevk)
-
-
1 pull request opened.
-
Remove document policy from this repo. w3c/webappsec-permissions-policy#416, by @clelland.
-
-
1 pull request merged.
-
Remove document policy from this repo. w3c/webappsec-permissions-policy#416.
-
-
1 pull request received 2 new comments.
-
Remove document policy from this repo. w3c/webappsec-permissions-policy#416 (2 comments by @annevk, @clelland)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
Drop cache w3c/webappsec-clear-site-data#68, by @annevk.
-
-
1 issue received 1 new comment.
w3c/webcrypto
-
1 issue opened.
-
Dummy horizontal tracker test (ignore me) w3c/webcrypto#246, by @plehegar.
-
-
1 issue closed.
-
Dummy horizontal tracker test (ignore me) w3c/webcrypto#246.
-
-
4 issues received 4 new comments.
w3c/trusted-types
-
1 issue opened.
-
Trusted Types from other realms are allowed and don't check allowed policy names w3c/trusted-types#303, by @TomiBelan.
-
-
1 issue closed.
-
Trusted Types from other realms are allowed and don't check allowed policy names w3c/trusted-types#303.
-
-
1 issue received 3 new comments.
-
Trusted Types from other realms are allowed and don't check allowed policy names w3c/trusted-types#303 (3 comments by @koto, @TomiBelan)
-
w3c/webappsec-mixed-content
-
1 pull request opened.
-
Fix typo: upgrade should turn scheme into https w3c/webappsec-mixed-content#37, by @bokand.
-
GitHub
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Support for disabled by default features? w3c/webappsec-permissions-policy#412, by @acomminos.
-
Move Document Policy w3c/webappsec-permissions-policy#411, by @annevk.
-
-
4 issues closed.
-
Proposal: Parameterized features w3c/webappsec-permissions-policy#163.
-
[Proposal] Different script contexts with different feature policy. w3c/webappsec-permissions-policy#238.
-
Need to define behaviour of features in associated browsing contexts w3c/webappsec-permissions-policy#173.
-
Header should be sufficient in some cases to delegate features (esp. Client Hints) w3c/webappsec-permissions-policy#408.
-
-
8 issues received 21 new comments.
-
Header should be sufficient in some cases to delegate features (esp. Client Hints) w3c/webappsec-permissions-policy#408 (6 comments by @annevk, @clelland, @yoavweiss)
-
Permissions Policy JS API w3c/webappsec-permissions-policy#401 (4 comments by @annevk, @clelland, @johannhof)
-
Support for disabled by default features? w3c/webappsec-permissions-policy#412 (2 comments by @acomminos, @annevk)
-
Need to define behaviour of features in associated browsing contexts w3c/webappsec-permissions-policy#173 (2 comments by @annevk, @clelland)
-
[Proposal] Different script contexts with different feature policy. w3c/webappsec-permissions-policy#238 (1 comment by @clelland)
-
Usefulness of reporting in Permissions Policy w3c/webappsec-permissions-policy#386 (1 comment by @ScottHelme)
-
-
1 pull request opened.
-
Client hints explainer w3c/webappsec-permissions-policy#413, by @clelland.
-
-
3 pull requests merged.
-
Client hints explainer w3c/webappsec-permissions-policy#413.
-
Update all links to webappsec-permissions-policy w3c/webappsec-permissions-policy#400.
-
s/feature-policy/permissions-policy in urls w3c/webappsec-permissions-policy#407.
-
-
1 pull request closed.
-
Allow header to enable features. w3c/webappsec-permissions-policy#409.
-
-
3 pull requests received 6 new comments.
-
s/feature-policy/permissions-policy in urls w3c/webappsec-permissions-policy#407 (1 comment by @clelland)
w3c/webappsec-secure-contexts
-
1 issue opened.
-
about:blank" or "about:srcdoc" with query string or fragment should be potentially trustworthy w3c/webappsec-secure-contexts#81, by @fred-wang.
-
-
1 issue received 2 new comments.
-
about:blank" or "about:srcdoc" with query string or fragment should be potentially trustworthy w3c/webappsec-secure-contexts#81 (2 comments by @annevk, @fred-wang)
-
w3c/webappsec-fetch-metadata
-
1 pull request opened.
-
Update iframe example in README.md w3c/webappsec-fetch-metadata#60, by @Malvoz.
-
-
1 pull request merged.
-
Update iframe example in README.md w3c/webappsec-fetch-metadata#60.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
4 issues opened.
-
Proposal: Add report field to signal if a violation was triggered by a browser extension w3c/webappsec-csp#450, by @ureesoriano.
-
CSP violations triggered by scripts: no 'source-file' or 'script-sample'? w3c/webappsec-csp#449, by @ureesoriano.
-
Percent-decode is used incorrectly w3c/webappsec-csp#448, by @annevk.
-
Address Bikeshed warnings w3c/webappsec-csp#446, by @annevk.
-
-
1 issue closed.
-
Proposal: Add report field to signal if a violation was triggered by a browser extension w3c/webappsec-csp#450.
-
-
6 issues received 11 new comments.
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256 (4 comments by @koto, @KristianH, @lukos)
-
CSP violations triggered by scripts: no 'source-file' or 'script-sample'? w3c/webappsec-csp#449 (2 comments by @dveditz, @ureesoriano)
-
Proposal: Add report field to signal if a violation was triggered by a browser extension w3c/webappsec-csp#450 (2 comments by @koto, @ureesoriano)
-
Make user's the driver of the user-agent again: bookmarklets, userscripts w3c/webappsec-csp#444 (1 comment by @dveditz)
-
-
2 pull requests opened.
-
Meta: correct percent-decode reference w3c/webappsec-csp#447, by @annevk.
-
Meta: export algorithms used by Fetch w3c/webappsec-csp#445, by @annevk.
-
-
5 pull requests merged.
-
Drop mention of obsolete require-sri-for directive w3c/webappsec-csp#417.
-
typo: s/thich/which/ w3c/webappsec-csp#393.
-
Meta: correct percent-decode reference w3c/webappsec-csp#447.
-
Meta: export algorithms used by Fetch w3c/webappsec-csp#445.
-
Trim input parameters to HTML hooks w3c/webappsec-csp#436.
-
-
1 pull request received 10 new comments.
w3c/trusted-types
-
2 issues opened.
-
Compare polyfill versions and the native implementation in the documentation w3c/trusted-types#301, by @koto.
-
insertAdjacentText in polyfill w3c/trusted-types#300, by @koto.
-
-
1 issue closed.
-
Add a target suitable for nodejs. w3c/trusted-types#190.
-
-
2 issues received 2 new comments.
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (1 comment by @koto)
-
-
1 pull request opened.
-
Changed the default policy arguments. w3c/trusted-types#302, by @koto.
-
-
4 pull requests merged.
-
Changed the default policy arguments. w3c/trusted-types#302.
-
Correct return value in example code w3c/trusted-types#291.
-
Correct reference to HTMLScriptElement w3c/trusted-types#292.
-
Using TT polyfill in nodejs environment w3c/trusted-types#299.
-
-
3 pull requests received 45 new comments.
w3c/webappsec-referrer-policy
-
1 issue received 1 new comment.
-
1 pull request merged.
-
Make strict-origin-when-cross-origin the default referrer policy w3c/webappsec-referrer-policy#142.
-
-
1 pull request received 3 new comments.
-
Make strict-origin-when-cross-origin the default referrer policy w3c/webappsec-referrer-policy#142 (3 comments by @domfarolino, @krgovind)
-
w3c/permissions
-
2 issues opened.
-
PWA install permission w3c/permissions#227, by @FluorescentHallucinogen.
-
[question] permission scope w3c/permissions#226, by @akosyakov.
-
-
1 issue received 2 new comments.
-
1 pull request opened.
-
Use media device permission revocation algorithm. w3c/permissions#225, by @jan-ivar.
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
"a priori authenticated URL" is now equivalent to "potentially trustworthy URL" w3c/webappsec-mixed-content#35, by @fred-wang.
-
-
1 issue closed.
-
"a priori authenticated URL" is now equivalent to "potentially trustworthy URL" w3c/webappsec-mixed-content#35.
-
-
2 issues received 9 new comments.
-
Clarify mixed content behavior for access to origins in CIDR 127.0.0.0/8 or ::1/128 w3c/webappsec-mixed-content#17 (7 comments by @annevk, @fred-wang, @mikewest)
-
-
2 pull requests opened.
-
Remove a priori authenticated concept from MIX2 w3c/webappsec-mixed-content#36, by @carlosjoan91.
-
Make default "Editor's Draft" URL point to MIX2 instead of MIX w3c/webappsec-mixed-content#34, by @carlosjoan91.
-
-
2 pull requests merged.
-
Remove a priori authenticated concept from MIX2 w3c/webappsec-mixed-content#36.
-
Make default "Editor's Draft" URL point to MIX2 instead of MIX w3c/webappsec-mixed-content#34.
-
-
2 pull requests received 12 new comments.
-
Make default "Editor's Draft" URL point to MIX2 instead of MIX w3c/webappsec-mixed-content#34 (9 comments by @annevk, @carlosjoan91)
-
Remove a priori authenticated concept from MIX2 w3c/webappsec-mixed-content#36 (3 comments by @carlosjoan91, @mikewest)
-
w3c/webappsec
-
1 pull request opened.
-
Propose adding document policy to 2020-11-17 agenda w3c/webappsec#570, by @clelland.
-
-
1 pull request merged.
-
Propose adding document policy to 2020-11-17 agenda w3c/webappsec#570.
-
w3c/webcrypto
-
1 pull request merged.
-
Use ReSpec autolinking capabilities w3c/webcrypto#242.
-
Participants
-
1 participant left.
-
Deian Stefan (GitStar) left.
-
-
1 organization left.
-
GitStar left.
-
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
Make user's the driver of the user-agent again: bookmarklets, userscripts w3c/webappsec-csp#444, by @rektide.
-
Need a specific CSP policy for enabling WebAssembly execution w3c/webappsec-csp#443, by @juj.
-
-
1 issue closed.
-
Make user's the driver of the user-agent again: bookmarklets, userscripts w3c/webappsec-csp#444.
-
-
2 issues received 8 new comments.
-
Make user's the driver of the user-agent again: bookmarklets, userscripts w3c/webappsec-csp#444 (7 comments by @annevk, @ArthurSonzogni, @rektide)
-
Need a specific CSP policy for enabling WebAssembly execution w3c/webappsec-csp#443 (1 comment by @dschuff)
-
-
1 pull request closed.
-
Fixes a typo in strict-dynamic-usage w3c/webappsec-csp#380.
-
-
1 pull request received 1 new comment.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (1 comment by @paolosevMSFT)
-
w3c/webcrypto
-
2 issues opened.
-
Persistent storage against webkit's ITP w3c/webcrypto#245, by @nerocrux.
-
Best practice for webkit's Intelligent Tracking Prevention (ITP) w3c/webcrypto#244, by @nerocrux.
-
-
1 issue closed.
-
Best practice for webkit's Intelligent Tracking Prevention (ITP) w3c/webcrypto#244.
-
-
1 issue received 1 new comment.
-
Best practice for webkit's Intelligent Tracking Prevention (ITP) w3c/webcrypto#244 (1 comment by @nerocrux)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Proposal: Transition 'sync-xhr' feature to Document Policy w3c/webappsec-permissions-policy#410, by @clelland.
-
Header should be sufficient in some cases to delegate features (esp. Client Hints) w3c/webappsec-permissions-policy#408, by @clelland.
-
-
3 issues received 12 new comments.
-
Proposal: Transition 'sync-xhr' feature to Document Policy w3c/webappsec-permissions-policy#410 (6 comments by @annevk, @arturjanc, @clelland, @martinthomson, @mikewest, @yoavweiss)
-
Header should be sufficient in some cases to delegate features (esp. Client Hints) w3c/webappsec-permissions-policy#408 (5 comments by @annevk, @clelland, @yoavweiss)
-
-
2 pull requests opened.
-
Allow header to enable features. w3c/webappsec-permissions-policy#409, by @clelland.
-
s/feature-policy/permissions-policy in urls w3c/webappsec-permissions-policy#407, by @tantek.
-
w3c/trusted-types
-
1 issue closed.
-
Operations must not be overloaded across interface, partial interface, etc. w3c/trusted-types#283.
-
-
1 issue reopened.
-
Operations must not be overloaded across interface, partial interface, etc. w3c/trusted-types#283, by @koto.
-
-
2 issues received 4 new comments.
-
Operations must not be overloaded across interface, partial interface, etc. w3c/trusted-types#283 (3 comments by @foolip, @koto)
-
-
3 pull requests opened.
-
Using TT polyfill in nodejs environment w3c/trusted-types#299, by @Siegrift.
-
spec: typo fix w3c/trusted-types#298, by @Malvoz.
-
Disable IDL index w3c/trusted-types#297, by @koto.
-
-
2 pull requests merged.
-
spec: typo fix w3c/trusted-types#298.
-
Disable IDL index w3c/trusted-types#297.
-
-
2 pull requests received 24 new comments.
w3c/webappsec-clear-site-data
-
1 issue opened.
-
clear-site-data and reliability w3c/webappsec-clear-site-data#67, by @ha-douken.
-
w3c/webappsec-credential-management
-
3 issues opened.
-
Enable a new CryptoKey Credential to provide a possession factor w3c/webappsec-credential-management#152, by @Goosth.
-
Would it be possible to add an example for navigator.credentials.create usage? w3c/webappsec-credential-management#151, by @SilentImp.
-
Question about usage of the federated credentials. w3c/webappsec-credential-management#150, by @SilentImp.
-
w3c/permissions
-
1 issue opened.
-
Gauging interest in a Permission Handler API? w3c/permissions#224, by @jcayzac.
-
-
1 issue received 1 new comment.
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
New 'Sec-Fetch-Dest' Type - "import" w3c/webappsec-fetch-metadata#59, by @Randy-Buchholz.
-
-
1 issue received 3 new comments.
-
New 'Sec-Fetch-Dest' Type - "import" w3c/webappsec-fetch-metadata#59 (3 comments by @annevk, @mikewest, @Randy-Buchholz)
-
w3c/webappsec-change-password-url
-
1 issue opened.
-
Register with IANA w3c/webappsec-change-password-url#32, by @hober.
-
-
1 pull request opened.
-
Add Elaine Knight as an editor of the HTTP response code reliability document. w3c/webappsec-change-password-url#33, by @hober.
-
Participants
-
3 participants joined.
-
Arthur Hemery (Google LLC) joined.
-
Eryn Wells (Apple Inc.) joined.
-
Elaine Knight (Apple Inc.) joined.
-
GitHub
w3c/trusted-types
-
1 issue opened.
-
Access the source/file that is using the 'default' policy w3c/trusted-types#295, by @jeberly.
-
-
1 issue closed.
-
Access the source/file that is using the 'default' policy w3c/trusted-types#295.
-
-
3 issues received 7 new comments.
-
Operations must not be overloaded across interface, partial interface, etc. w3c/trusted-types#283 (4 comments by @foolip, @koto)
-
Access the source/file that is using the 'default' policy w3c/trusted-types#295 (2 comments by @koto, @Sora2455)
-
-
2 pull requests opened.
-
Update browser native support info w3c/trusted-types#294, by @rictic.
-
2 pull requests merged.
-
Fix #283 w3c/trusted-types#296.
-
Update browser native support info w3c/trusted-types#294.
-
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
3 issues opened.
-
Make policy scope clear and address tracking risks in the privacy section w3c/webappsec-permissions-policy#406, by @johnwilander.
-
"This version" link still points to old repo GH page w3c/webappsec-permissions-policy#403, by @cynthia.
-
Permissions Policy JS API w3c/webappsec-permissions-policy#401, by @clelland.
-
-
2 issues closed.
-
"This version" link still points to old repo GH page w3c/webappsec-permissions-policy#403.
-
commas and semicolons both allowed, with different rules for overriding w3c/webappsec-permissions-policy#148.
-
-
5 issues received 13 new comments.
-
Make policy scope clear and address tracking risks in the privacy section w3c/webappsec-permissions-policy#406 (5 comments by @annevk, @clelland, @johnwilander)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (3 comments by @clelland, @laukstein, @sam-spain)
-
Feature Proposal: Client Hints delegation w3c/webappsec-permissions-policy#129 (3 comments by @abdulhannanali, @yoavweiss)
-
commas and semicolons both allowed, with different rules for overriding w3c/webappsec-permissions-policy#148 (1 comment by @clelland)
-
-
3 pull requests opened.
-
Alphabetize list of features w3c/webappsec-permissions-policy#405, by @dbaron.
-
Fix this version and repository links to avoid redirects w3c/webappsec-permissions-policy#404, by @dbaron.
-
Remove deprecated allowpaymentrequest attribute w3c/webappsec-permissions-policy#402, by @marcoscaceres.
-
-
3 pull requests merged.
-
Alphabetize list of features w3c/webappsec-permissions-policy#405.
-
Fix this version and repository links to avoid redirects w3c/webappsec-permissions-policy#404.
-
Remove deprecated allowpaymentrequest attribute w3c/webappsec-permissions-policy#402.
-
-
3 pull requests received 14 new comments.
-
Remove deprecated allowpaymentrequest attribute w3c/webappsec-permissions-policy#402 (10 comments by @clelland, @danyao, @marcoscaceres, @sideshowbarker, @wseltzer)
-
Fix this version and repository links to avoid redirects w3c/webappsec-permissions-policy#404 (2 comments by @clelland)
-
w3c/webcrypto
-
1 issue opened.
-
1 issue received 1 new comment.
-
[RSA-PSS 21.4. Operations - Sign]: RFC3447 does not define an EMM-PSS-ENCODE operation, typo? w3c/webcrypto#241 (1 comment by @jimsch)
-
-
2 pull requests opened.
-
Fix name of EMSA-PSS-Encode operation w3c/webcrypto#243, by @dontcallmedom.
-
Use ReSpec autolinking capabilities w3c/webcrypto#242, by @dontcallmedom.
-
-
1 pull request merged.
-
fix: algorithm mappings invalid ECMAScript w3c/webcrypto#239.
-
w3c/webappsec-csp
-
1 issue opened.
-
Document that line-number and column-number are 1-based in CSP reporting spec w3c/webappsec-csp#442, by @adob.
-
-
2 issues received 5 new comments.
w3c/webappsec-referrer-policy
-
1 pull request received 1 new comment.
-
Make strict-origin-when-cross-origin the default referrer policy w3c/webappsec-referrer-policy#142 (1 comment by @domfarolino)
-
w3c/webappsec
-
2 issues received 2 new comments.
-
2 pull requests opened.
-
Add the two change-password-url specs to the list. w3c/webappsec#569, by @hober.
-
Add agenda item about disabling badness with Document Policy w3c/webappsec#568, by @arturjanc.
-
-
1 pull request merged.
-
Add agenda item about disabling badness with Document Policy w3c/webappsec#568.
-
w3c/webappsec-change-password-url
-
2 issues opened.
-
Update references & redirects to these documents w3c/webappsec-change-password-url#31, by @hober.
-
Specifying navigations affected by .well-known/change-password w3c/webappsec-change-password-url#29, by @battre.
-
-
1 pull request opened.
-
Migrate from WICG w3c/webappsec-change-password-url#30, by @wseltzer.
-
-
1 pull request merged.
-
Migrate from WICG w3c/webappsec-change-password-url#30.
-
w3c/webappsec-secure-contexts
-
1 pull request opened.
-
Fix typo in example description w3c/webappsec-secure-contexts#80, by @CYBAI.
-
w3c/webappsec-mixed-content
-
1 issue closed.
-
Update to account for removal of HTTPS state w3c/webappsec-mixed-content#32.
-
-
1 pull request opened.
-
Fix https state w3c/webappsec-mixed-content#33, by @carlosjoan91.
-
-
1 pull request merged.
-
Fix https state w3c/webappsec-mixed-content#33.
-
-
1 pull request received 3 new comments.
w3c/webappsec-subresource-integrity
-
1 pull request opened.
-
Updated index.html w3c/webappsec-subresource-integrity#93, by @nicehearted.
-
w3c/webappsec-cspee
-
1 pull request merged.
-
Fix source list intersection algorithm w3c/webappsec-cspee#18.
-
Participants
-
5 participants joined.
-
Marshall Vale (Google LLC) joined.
-
Melanie Richards (Microsoft Corporation) joined.
-
Kaustubha Govind (Google LLC) joined.
-
Erhard Brand (Entersekt) joined.
-
Gerhard Oosthuizen (Entersekt) joined.
-
-
3 participants left.
-
Travis Leithead (Microsoft Corporation) left.
-
Swapnil Deshmukh (Certus Cybersecurity Solutions LLC) left.
-
Anthony Nadalin (Microsoft Corporation) left.
-
-
1 organization joined.
-
Entersekt joined.
-
-
1 organization left.
-
Certus Cybersecurity Solutions LLC left.
-
GitHub
w3c/trusted-types
-
1 issue opened.
-
Consider enforcing TT for custom attributes. w3c/trusted-types#288, by @mikewest.
-
-
2 issues received 2 new comments.
-
Operations must not be overloaded across interface, partial interface, etc. w3c/trusted-types#283 (1 comment by @koto)
-
6 pull requests opened.
-
Correct reference to HTMLScriptElement w3c/trusted-types#292, by @jugglinmike.
-
Correct return value in example code w3c/trusted-types#291, by @jugglinmike.
-
Correct typo w3c/trusted-types#290, by @jugglinmike.
-
Update WebIDL attribute name w3c/trusted-types#289, by @jugglinmike.
-
Correct uses of partial interface IDL syntax w3c/trusted-types#287, by @saschanaz.
-
Fix spec after [Constructor] deprecation w3c/trusted-types#286, by @Siegrift.
-
-
4 pull requests merged.
-
Correct typo w3c/trusted-types#290.
-
Update WebIDL attribute name w3c/trusted-types#289.
-
Correct uses of partial interface IDL syntax w3c/trusted-types#287.
-
Fix spec after [Constructor] deprecation w3c/trusted-types#286.
-
-
3 pull requests received 4 new comments.
w3c/webappsec-csp
-
3 issues opened.
-
host-part matching should allow IPv6 "[::1]" as it does for "127.0.0.1" w3c/webappsec-csp#440, by @ghost.
-
Does http://example.com:80 match https://example.com? w3c/webappsec-csp#439, by @antosart.
-
Cross-realm eval() calls and 'unsafe-eval' w3c/webappsec-csp#438, by @TomiBelan.
-
-
6 issues received 14 new comments.
-
Looking for guidance on defining CSP for <portal> w3c/webappsec-csp#437 (5 comments by @devd, @domenic)
-
Does http://example.com:80 match https://example.com? w3c/webappsec-csp#439 (4 comments by @annevk, @antosart)
-
Cross-realm eval() calls and 'unsafe-eval' w3c/webappsec-csp#438 (2 comments by @annevk, @TomiBelan)
-
w3c/webcrypto
-
1 issue received 1 new comment.
w3c/webappsec-mixed-content
-
1 issue opened.
-
Update to account for removal of HTTPS state w3c/webappsec-mixed-content#32, by @annevk.
-
-
2 issues received 5 new comments.
-
Update to account for removal of HTTPS state w3c/webappsec-mixed-content#32 (4 comments by @annevk, @carlosjoan91, @estark37)
-
-
1 pull request merged.
-
Fix "requires prohibits" w3c/webappsec-mixed-content#29.
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue received 1 new comment.
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183 (1 comment by @ashishkummar)
-
-
1 pull request opened.
-
Update all links to webappsec-permissions-policy w3c/webappsec-permissions-policy#400, by @tidoust.
-
-
1 pull request closed.
-
Add clipboard-read and clipboard-write Feature Policies w3c/webappsec-permissions-policy#385.
-
-
2 pull requests received 2 new comments.
-
Add clipboard-read and clipboard-write Feature Policies w3c/webappsec-permissions-policy#385 (1 comment by @clelland)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Possible Version 2 w3c/webappsec-referrer-policy#143, by @craigfrancis.
-
-
1 pull request opened.
-
Make strict-origin-when-cross-origin the default referrer policy w3c/webappsec-referrer-policy#142, by @krgovind.
-
-
1 pull request closed.
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125.
-
-
2 pull requests received 13 new comments.
-
Make strict-origin-when-cross-origin the default referrer policy w3c/webappsec-referrer-policy#142 (11 comments by @annevk, @johnwilander, @krgovind, @yoavweiss)
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125 (2 comments by @domfarolino, @krgovind)
-
w3c/webappsec-credential-management
-
1 pull request opened.
-
Editorial: Align with Web IDL specification w3c/webappsec-credential-management#149, by @autokagami.
-
w3c/webappsec
-
1 pull request opened.
-
Update 2020-08-18-agenda.md w3c/webappsec#567, by @hackademix.
-
-
1 pull request merged.
-
Update 2020-08-18-agenda.md w3c/webappsec#567.
-
w3c/webappsec-change-password-url
-
1 pull request opened.
-
https://archive.org/download/iptvsmarterstvbox-2.2.2.1/yelbastv.m3u w3c/webappsec-change-password-url#28, by @musty1974.
-
-
1 pull request closed.
-
https://archive.org/download/iptvsmarterstvbox-2.2.2.1/yelbastv.m3u w3c/webappsec-change-password-url#28.
-
w3c/webappsec-cspee
-
2 issues opened.
-
Meaning of 'self' in csp attribute w3c/webappsec-cspee#16, by @antosart.
-
Wildcard hosts and CSP source intersection w3c/webappsec-cspee#14, by @antosart.
-
-
3 pull requests opened.
-
Fix source list intersection algorithm w3c/webappsec-cspee#18, by @antosart.
-
Rewrite source expression intersection without using similarity w3c/webappsec-cspee#17, by @antosart.
-
Fix example of non-similar CSP sources with different ports w3c/webappsec-cspee#15, by @antosart.
-
-
1 pull request received 1 new comment.
-
Rewrite source expression intersection without using similarity w3c/webappsec-cspee#17 (1 comment by @antosart)
-
w3c/permissions
-
1 issue received 1 new comment.
TR publications
-
2 documents published.
-
Permissions published as a Working Draft. History of Permissions
-
Permissions Policy published as a Working Draft. History of Permissions Policy
-
Participants
-
10 participants joined.
-
Illia Klimov (Google LLC) joined.
-
Yifan Luo (Google LLC) joined.
-
Arthur SONZOGNI (Google LLC) joined.
-
Titouan Rigoudy (Google LLC) joined.
-
Paris MEULEMAN (Google LLC) joined.
-
Antonio Sartori (Google LLC) joined.
-
Richard Stotz (Google LLC) joined.
-
Maud Nalpas (Google LLC) joined.
-
Camille Lamy (Google LLC) joined.
-
Jack J (Google LLC) joined.
-
-
1 participant left.
-
Axel Nennker (Deutsche Telekom AG) left.
-
-
1 organization left.
-
Deutsche Telekom AG left.
-
GitHub
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Ability to prevent tabnabbing with the referrer-policy header w3c/webappsec-referrer-policy#141, by @ConradIrwin.
-
-
2 issues closed.
-
Ability to prevent tabnabbing with the referrer-policy header w3c/webappsec-referrer-policy#141.
-
Drop mentions of HTML5 w3c/webappsec-referrer-policy#134.
-
-
1 issue received 3 new comments.
-
Ability to prevent tabnabbing with the referrer-policy header w3c/webappsec-referrer-policy#141 (3 comments by @annevk, @ConradIrwin)
-
-
1 pull request merged.
-
Remove HTML5 note w3c/webappsec-referrer-policy#140.
-
-
1 pull request received 1 new comment.
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125 (1 comment by @krgovind)
-
w3c/webappsec-clear-site-data
-
3 issues opened.
-
Clear-Site-Data and partitioning w3c/webappsec-clear-site-data#66, by @annevk.
-
clear basic auth info w3c/webappsec-clear-site-data#65, by @Jxck.
-
Clear-Site-Data and sandboxing w3c/webappsec-clear-site-data#64, by @annevk.
-
-
2 issues received 2 new comments.
-
1 pull request closed.
-
Fix broken links to RFC 7230 w3c/webappsec-clear-site-data#62.
-
w3c/webappsec-csp
-
1 issue opened.
-
Looking for guidance on defining CSP for <portal> w3c/webappsec-csp#437, by @domenic.
-
-
1 issue received 2 new comments.
-
1 pull request opened.
-
Trim input parameters to HTML hooks w3c/webappsec-csp#436, by @domenic.
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
Provide guidance on what to throw? w3c/webappsec-permissions-policy#396, by @marcoscaceres.
-
Update "creating a feature policy" to use embedder w3c/webappsec-permissions-policy#390, by @domenic.
-
Please consider sending a PR to HTML to update for all the renames w3c/webappsec-permissions-policy#389, by @domenic.
-
-
1 issue closed.
-
Please consider sending a PR to HTML to update for all the renames w3c/webappsec-permissions-policy#389.
-
-
5 issues received 10 new comments.
-
Renaming Feature Policy w3c/webappsec-permissions-policy#359 (4 comments by @clelland, @marcoscaceres)
-
Provide guidance on what to throw? w3c/webappsec-permissions-policy#396 (2 comments by @clelland, @marcoscaceres)
-
Remove '*' default allowlist w3c/webappsec-permissions-policy#381 (2 comments by @annevk, @yoavweiss)
-
Please consider sending a PR to HTML to update for all the renames w3c/webappsec-permissions-policy#389 (1 comment by @clelland)
-
-
7 pull requests opened.
-
Add "speaker-selection" permissions policy. w3c/webappsec-permissions-policy#398, by @jan-ivar.
-
Gamepad is proposed w3c/webappsec-permissions-policy#397, by @marcoscaceres.
-
geolocation permission policy was merged w3c/webappsec-permissions-policy#395, by @marcoscaceres.
-
web-share permission policy w3c/webappsec-permissions-policy#394, by @ewilligers.
-
Editorial: align with Fetch's structured field changes w3c/webappsec-permissions-policy#393, by @annevk.
-
Polish changes to Permissions Policy explainer w3c/webappsec-permissions-policy#392, by @jpchase.
-
New explainer w3c/webappsec-permissions-policy#391, by @clelland.
-
-
7 pull requests merged.
-
Add "speaker-selection" permissions policy. w3c/webappsec-permissions-policy#398.
-
Gamepad is proposed w3c/webappsec-permissions-policy#397.
-
geolocation permission policy was merged w3c/webappsec-permissions-policy#395.
-
web-share permission policy w3c/webappsec-permissions-policy#394.
-
Editorial: align with Fetch's structured field changes w3c/webappsec-permissions-policy#393.
-
Polish changes to Permissions Policy explainer w3c/webappsec-permissions-policy#392.
-
New explainer w3c/webappsec-permissions-policy#391.
-
-
6 pull requests received 15 new comments.
-
Polish changes to Permissions Policy explainer w3c/webappsec-permissions-policy#392 (8 comments by @clelland, @jpchase)
-
geolocation permission policy was merged w3c/webappsec-permissions-policy#395 (2 comments by @clelland)
-
web-share permission policy w3c/webappsec-permissions-policy#394 (2 comments by @clelland, @ewilligers)
-
Add clipboard-read and clipboard-write Feature Policies w3c/webappsec-permissions-policy#385 (1 comment by @clelland)
-
Editorial: align with Fetch's structured field changes w3c/webappsec-permissions-policy#393 (1 comment by @annevk)
-
w3c/permissions
-
4 issues opened.
-
Write a Security Considerations section w3c/permissions#221, by @jyasskin.
-
chore: Turn on `Assume Explicit For` w3c/permissions#220, by @jyasskin.
-
Publish new WD to /TR? w3c/permissions#215, by @wseltzer.
-
Custom PermissionName definitions in other host environments w3c/permissions#212, by @nayeemrmn.
-
-
1 issue closed.
-
Script origin bound permissions w3c/permissions#211.
-
-
3 issues received 16 new comments.
-
Publish new WD to /TR? w3c/permissions#215 (11 comments by @jyasskin, @marcoscaceres, @tabatkins, @wseltzer)
-
-
5 pull requests opened.
-
Remove clipboard-read w3c/permissions#222, by @marcoscaceres.
-
Auto-fetch the previous version link. w3c/permissions#219, by @jyasskin.
-
Rename "speaker" to "speaker-selection" + media devices are secure context w3c/permissions#218, by @jan-ivar.
-
Remove almost all link-defaults. w3c/permissions#217, by @jyasskin.
-
Noexport the "Set Permission" dfn to fix a Bikeshed warning. w3c/permissions#216, by @jyasskin.
-
-
3 pull requests merged.
-
Remove almost all link-defaults. w3c/permissions#217.
-
Noexport the "Set Permission" dfn to fix a Bikeshed warning. w3c/permissions#216.
-
Rename "speaker" to "speaker-selection" + media devices are secure context w3c/permissions#218.
-
-
3 pull requests received 9 new comments.
-
Rename "speaker" to "speaker-selection" + media devices are secure context w3c/permissions#218 (3 comments by @annevk, @jan-ivar, @marcoscaceres)
-
Noexport the "Set Permission" dfn to fix a Bikeshed warning. w3c/permissions#216 (2 comments by @jyasskin, @marcoscaceres)
w3c/trusted-types
-
1 issue opened.
-
Operations must not be overloaded across interface, partial interface, etc. w3c/trusted-types#283, by @foolip.
-
-
1 issue received 3 new comments.
-
1 pull request opened.
-
Fix invalid Web IDL syntax w3c/trusted-types#282, by @foolip.
-
-
1 pull request received 3 new comments.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Remove the `integrity` IDL attributes w3c/webappsec-subresource-integrity#92, by @foolip.
-
-
1 issue received 1 new comment.
w3c/webappsec-secure-contexts
-
2 issues opened.
-
Upstream monkey-patches to HTML and delete in this spec w3c/webappsec-secure-contexts#79, by @foolip.
-
localhost domains and HTTP/2 and beyond w3c/webappsec-secure-contexts#78, by @annevk.
-
-
3 issues reopened.
-
"Is an environment settings object contextually secure?" does not work for worklets w3c/webappsec-secure-contexts#57, by @annevk.
-
"Is an environment settings object contextually secure?" does not deal with nested workers w3c/webappsec-secure-contexts#56, by @annevk.
-
secure contexts and Workers created from data URLs w3c/webappsec-secure-contexts#74, by @annevk.
-
-
3 issues received 3 new comments.
-
"Is an environment settings object contextually secure?" does not work for worklets w3c/webappsec-secure-contexts#57 (1 comment by @annevk)
-
"Is an environment settings object contextually secure?" does not deal with nested workers w3c/webappsec-secure-contexts#56 (1 comment by @annevk)
-
secure contexts and Workers created from data URLs w3c/webappsec-secure-contexts#74 (1 comment by @annevk)
-
-
1 pull request reopened.
-
Always use creation URL to determine trustworthiness w3c/webappsec-secure-contexts#75, by @annevk.
-
w3c/webappsec
-
2 pull requests closed.
-
Update shortname to ui-security w3c/webappsec#558.
-
Add missing specifications, update links to HTTPS w3c/webappsec#554.
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Fetch integration w3c/webappsec-fetch-metadata#58, by @annevk.
-
-
1 issue received 4 new comments.
-
`Sec-Fetch-Site` for requests from extension background pages w3c/webappsec-fetch-metadata#47 (4 comments by @annevk, @arturjanc, @iVanlIsh)
-
w3c/webappsec-change-password-url
-
1 issue opened.
-
Broken reference for "Appropriate Use of Well-Known URIs" w3c/webappsec-change-password-url#26, by @psimonyi.
-
w3c/webappsec-cspee
-
1 pull request opened.
-
Fix examples involving wildcard host matching. w3c/webappsec-cspee#13, by @antosart.
-
TR publications
-
1 document published.
-
Cross-Origin Resource Sharing published as a Recommendation. History of Cross-Origin Resource Sharing
-
Participants
-
2 participants joined.
-
Dominic Farolino (Google LLC) joined.
-
Mingzhe Li (Akamai Technologies) joined.
-
GitHub
w3c/webappsec-referrer-policy
-
3 issues opened.
-
Strip url check for null url appears redundant w3c/webappsec-referrer-policy#139, by @gterzian.
-
Parameterised Referrer Policy w3c/webappsec-referrer-policy#138, by @Jxck.
-
[proposal] no-referrer-when-crossorigin w3c/webappsec-referrer-policy#136, by @Jxck.
-
-
3 issues closed.
-
Parameterised Referrer Policy w3c/webappsec-referrer-policy#138.
-
Inconsistencies with "same-origin" requests w3c/webappsec-referrer-policy#123.
-
[proposal] no-referrer-when-crossorigin w3c/webappsec-referrer-policy#136.
-
-
4 issues received 11 new comments.
-
[proposal] no-referrer-when-crossorigin w3c/webappsec-referrer-policy#136 (7 comments by @annevk, @domfarolino, @Jxck)
-
Parameterised Referrer Policy w3c/webappsec-referrer-policy#138 (2 comments by @domfarolino, @fmarier)
-
Strip url check for null url appears redundant w3c/webappsec-referrer-policy#139 (1 comment by @domfarolino)
-
-
2 pull requests opened.
-
Remove HTML5 note w3c/webappsec-referrer-policy#140, by @domfarolino.
-
Have no-referrer-when-downgrade specify stripping the URL as a referrer w3c/webappsec-referrer-policy#137, by @davidvancleve.
-
-
2 pull requests merged.
-
Use request's referrer for more things, instead of request's client w3c/webappsec-referrer-policy#135.
-
Have no-referrer-when-downgrade specify stripping the URL as a referrer w3c/webappsec-referrer-policy#137.
-
-
2 pull requests received 18 new comments.
-
Use request's referrer for more things, instead of request's client w3c/webappsec-referrer-policy#135 (12 comments by @domfarolino, @estark37)
-
Have no-referrer-when-downgrade specify stripping the URL as a referrer w3c/webappsec-referrer-policy#137 (6 comments by @annevk, @davidvancleve, @domfarolino)
-
w3c/permissions
-
2 issues opened.
-
Script origin bound permissions w3c/permissions#211, by @nuxodin.
-
Add "popups" permission type w3c/permissions#210, by @samuelmaddock.
-
-
3 issues received 16 new comments.
-
2 pull requests opened.
-
Update clipboard permissions as per Clipboard Specification. w3c/permissions#209, by @dway123.
-
Remove webdriver-spec.html from WebDriver URLs w3c/permissions#208, by @foolip.
-
-
2 pull requests merged.
-
Update clipboard permissions as per Clipboard Specification. w3c/permissions#209.
-
Remove webdriver-spec.html from WebDriver URLs w3c/permissions#208.
-
-
1 pull request closed.
-
Add ClipboardPermissionDescriptor w3c/permissions#155.
-
-
2 pull requests received 8 new comments.
-
Add ClipboardPermissionDescriptor w3c/permissions#155 (6 comments by @dway123, @marcoscaceres, @saschanaz)
-
Update clipboard permissions as per Clipboard Specification. w3c/permissions#209 (2 comments by @dway123, @marcoscaceres)
-
w3c/trusted-types
-
3 issues received 3 new comments.
-
Make input argument to createHTML, createScript, and createScriptURL optional w3c/trusted-types#278 (1 comment by @shhnjk)
-
-
1 pull request opened.
-
Fix 'none' keyword logic for 'trusted-types' directive. w3c/trusted-types#281, by @koto.
-
-
1 pull request merged.
-
Fix 'none' keyword logic for 'trusted-types' directive. w3c/trusted-types#281.
-
w3c/webappsec-csp
-
2 issues received 9 new comments.
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256 (6 comments by @AndrewStoyan, @dveditz, @laukstein, @mazen160, @nycnewman)
-
Obsolete https://w3c.github.io/webappsec-csp/api/? w3c/webappsec-csp#253 (3 comments by @arturjanc, @koto, @mikewest)
-
-
1 pull request received 2 new comments.
-
Minimal specification of 'wasm-unsafe-eval' source directive w3c/webappsec-csp#293 (2 comments by @annevk, @binji)
-
w3c/webappsec-secure-contexts
-
1 issue closed.
-
Republish spec? w3c/webappsec-secure-contexts#68.
-
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Document Policy Header as Dictionary w3c/webappsec-permissions-policy#387, by @clelland.
-
Usefulness of reporting in Permissions Policy w3c/webappsec-permissions-policy#386, by @clelland.
-
-
4 issues closed.
-
Document Policy Header as Dictionary w3c/webappsec-permissions-policy#387.
-
Spec source file uses "section autolinks" incorrectly, they'll start breaking w3c/webappsec-permissions-policy#361.
-
Dividing features across different types of policies w3c/webappsec-permissions-policy#296.
-
Feature Policy syntax: Structured Header? w3c/webappsec-permissions-policy#376.
-
-
3 issues received 13 new comments.
-
Remove '*' default allowlist w3c/webappsec-permissions-policy#381 (7 comments by @annevk, @clelland, @yoavweiss)
-
Document Policy Header as Dictionary w3c/webappsec-permissions-policy#387 (5 comments by @annevk, @clelland)
-
Dividing features across different types of policies w3c/webappsec-permissions-policy#296 (1 comment by @clelland)
-
-
3 pull requests opened.
-
Change Document Policy headers to sh-dictionary w3c/webappsec-permissions-policy#388, by @clelland.
-
Add clipboard-read and clipboard-write Feature Policies w3c/webappsec-permissions-policy#385, by @dway123.
-
Remove a spurious `s` from README w3c/webappsec-permissions-policy#384, by @yoavweiss.
-
-
3 pull requests merged.
-
Change Document Policy headers to sh-dictionary w3c/webappsec-permissions-policy#388.
-
Define "Permissions-Policy" as a structured header w3c/webappsec-permissions-policy#383.
-
Remove a spurious `s` from README w3c/webappsec-permissions-policy#384.
-
-
4 pull requests received 5 new comments.
-
Define "Permissions-Policy" as a structured header w3c/webappsec-permissions-policy#383 (2 comments by @clelland)
-
Create focus-without-user-activation.md w3c/webappsec-permissions-policy#304 (1 comment by @JSteunou)
-
Add clipboard-read and clipboard-write Feature Policies w3c/webappsec-permissions-policy#385 (1 comment by @annevk)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
NULL or DOMException w3c/webappsec-credential-management#148, by @equalsJeffH.
-
`publicKey` member identifier in Options should be `"public-key"`, or vice-versa? w3c/webappsec-credential-management#147, by @equalsJeffH.
-
w3c/webappsec-cspee
-
1 issue opened.
-
Should we restrict CSPEE to secure schemes? w3c/webappsec-cspee#12, by @antosart.
-
-
1 pull request opened.
-
Cancel navigation on invalid required CSP attribute w3c/webappsec-cspee#11, by @antosart.
-
-
1 pull request received 1 new comment.
w3c/webappsec
-
1 issue received 4 new comments.
-
CSP: Allow precise control of cookies w3c/webappsec#561 (4 comments by @dveditz, @hiburn8, @Malvoz, @sindastra)
-
w3c/webappsec-change-password-url
-
3 issues opened.
-
response-code-reliability checking for OK Status w3c/webappsec-change-password-url#24, by @battre.
-
Main branch should be named 'main' w3c/webappsec-change-password-url#23, by @hober.
-
Use GitHub Actions for deploying spec to the gh-pages branch w3c/webappsec-change-password-url#22, by @hober.
-
-
2 issues closed.
-
Use GitHub Actions for deploying spec to the gh-pages branch w3c/webappsec-change-password-url#22.
-
Main branch should be named 'main' w3c/webappsec-change-password-url#23.
-
-
3 issues received 6 new comments.
-
Who supports this? w3c/webappsec-change-password-url#16 (4 comments by @battre, @hober, @marcoscaceres)
-
w3c/webappsec-subresource-integrity
-
2 issues closed.
-
Integrity for service workers w3c/webappsec-subresource-integrity#66.
-
Consider shared caching w3c/webappsec-subresource-integrity#22.
-
-
2 issues received 7 new comments.
-
Integrity for service workers w3c/webappsec-subresource-integrity#66 (4 comments by @annevk, @llebout, @mozfreddyb)
-
w3c/webcrypto
-
1 issue received 1 new comment.
Participants
-
1 organization joined.
-
Saudi Federation for Cybersecurity, Programming, and Drones joined.
-
GitHub
w3c/webcrypto
-
1 issue opened.
-
Key usages too granular? w3c/webcrypto#240, by @ByteEater-pl.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
fix: algorithm mappings invalid ECMAScript w3c/webcrypto#239, by @panva.
-
w3c/webappsec-csp
-
1 issue opened.
-
Clarify/test which quote characters may be used w3c/webappsec-csp#434, by @foolip.
-
-
8 issues received 20 new comments.
-
Add way to define all country code top-level domain. w3c/webappsec-csp#256 (5 comments by @Drag13, @koto)
-
Clarify/test which quote characters may be used w3c/webappsec-csp#434 (3 comments by @annevk, @bakkot, @foolip)
-
Are nonces allowed/supported in frame-src? w3c/webappsec-csp#433 (3 comments by @arturjanc, @dveditz, @viraptor)
-
[CSP] specify handling of malformed content-security-policy HTTP header w3c/webappsec-csp#6 (1 comment by @foolip)
-
-
1 pull request opened.
-
Fix match-ports to handle a null input port w3c/webappsec-csp#435, by @antosart.
-
-
1 pull request received 8 new comments.
-
Fix match-ports to handle a null input port w3c/webappsec-csp#435 (8 comments by @annevk, @antosart)
-
w3c/webappsec-subresource-integrity
-
2 issues received 3 new comments.
-
A new IntegrityCheckFailure event w3c/webappsec-subresource-integrity#77 (2 comments by @mikewest, @mozfreddyb)
-
w3c/webappsec-cspee
-
1 issue opened.
-
Should file and filesystem schemes allow blanket enforcement? w3c/webappsec-cspee#10, by @antosart.
-
-
1 issue received 1 new comment.
-
Should file and filesystem schemes allow blanket enforcement? w3c/webappsec-cspee#10 (1 comment by @antosart)
-
-
1 pull request opened.
-
Fix subsume-source-expressions algorithm w3c/webappsec-cspee#9, by @antosart.
-
w3c/webappsec-permissions-policy
-
4 issues opened.
-
Remove '*' default allowlist w3c/webappsec-permissions-policy#381, by @annevk.
-
Feature Policy syntax: Structured Header? w3c/webappsec-permissions-policy#376, by @clelland.
-
Remove "requires acknowledgment" flag and associated machinery w3c/webappsec-permissions-policy#375, by @clelland.
-
Policies in data: urls w3c/webappsec-permissions-policy#374, by @clelland.
-
-
3 issues closed.
-
Renaming Feature Policy w3c/webappsec-permissions-policy#359.
-
Feature Policy shouldn't be overridable w3c/webappsec-permissions-policy#357.
-
Remove "requires acknowledgment" flag and associated machinery w3c/webappsec-permissions-policy#375.
-
-
5 issues received 36 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (14 comments by @dimaqq, @ewanm89, @laukstein, @Malvoz, @oliverjanik, @vphantom, @xdevs23)
-
Feature Policy syntax: Structured Header? w3c/webappsec-permissions-policy#376 (8 comments by @annevk, @arturjanc, @clelland, @johannhof)
-
Policies in data: urls w3c/webappsec-permissions-policy#374 (8 comments by @annevk, @clelland, @jan-ivar, @johannhof)
-
Renaming Feature Policy w3c/webappsec-permissions-policy#359 (4 comments by @annevk, @clelland, @sideshowbarker)
-
Remove '*' default allowlist w3c/webappsec-permissions-policy#381 (2 comments by @annevk, @clelland)
-
-
6 pull requests opened.
-
Define "Permissions-Policy" as a structured header w3c/webappsec-permissions-policy#383, by @clelland.
-
Meta: acknowledge former name w3c/webappsec-permissions-policy#382, by @annevk.
-
Cleanup algorithms w3c/webappsec-permissions-policy#380, by @clelland.
-
Rename all the things w3c/webappsec-permissions-policy#379, by @clelland.
-
Change FP inheritance w3c/webappsec-permissions-policy#378, by @clelland.
-
Remove "requires acknowledgment" flag from document policy w3c/webappsec-permissions-policy#377, by @clelland.
-
-
5 pull requests merged.
-
Meta: acknowledge former name w3c/webappsec-permissions-policy#382.
-
Cleanup algorithms w3c/webappsec-permissions-policy#380.
-
Rename all the things w3c/webappsec-permissions-policy#379.
-
Change FP inheritance w3c/webappsec-permissions-policy#378.
-
Remove "requires acknowledgment" flag from document policy w3c/webappsec-permissions-policy#377.
-
-
3 pull requests received 4 new comments.
-
Define "Permissions-Policy" as a structured header w3c/webappsec-permissions-policy#383 (2 comments by @annevk)
-
w3c/trusted-types
-
1 issue opened.
-
Make input argument to createHTML, createScript, and createScriptURL optional w3c/trusted-types#278, by @shhnjk.
-
-
1 issue closed.
-
Specify no Trusted Type Policies allowed w3c/trusted-types#253.
-
-
1 issue reopened.
-
Restrict to secure contexts w3c/trusted-types#259, by @koto.
-
-
5 issues received 19 new comments.
-
Restrict to secure contexts w3c/trusted-types#259 (8 comments by @annevk, @arturjanc, @koto, @shhnjk)
-
Expose information on status of TrustedTypes enforcement w3c/trusted-types#36 (5 comments by @engelsdamien, @koto, @otherdaniel)
-
Make input argument to createHTML, createScript, and createScriptURL optional w3c/trusted-types#278 (3 comments by @koto, @shhnjk)
-
-
2 pull requests opened.
-
Add `'none'` keyword support for `trusted-types` directive. w3c/trusted-types#280, by @koto.
-
Removed the secure context restrictions. w3c/trusted-types#279, by @koto.
-
-
1 pull request merged.
-
Add `'none'` keyword support for `trusted-types` directive. w3c/trusted-types#280.
-
w3c/webappsec-secure-contexts
-
3 pull requests opened.
-
Improve origin trustworthiness algorithm w3c/webappsec-secure-contexts#77, by @annevk.
-
Meta: no more fork of WHATWG HTML w3c/webappsec-secure-contexts#76, by @annevk.
-
Always use creation URL to determine trustworthiness w3c/webappsec-secure-contexts#75, by @annevk.
-
-
1 pull request received 2 new comments.
-
Improve origin trustworthiness algorithm w3c/webappsec-secure-contexts#77 (2 comments by @annevk, @clelland)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Drop mentions of HTML5 w3c/webappsec-referrer-policy#134, by @annevk.
-
-
2 pull requests opened.
-
Use request's referrer for more things, instead of request's client w3c/webappsec-referrer-policy#135, by @domfarolino.
-
Add <script> for `referrerpolicy` content attribute w3c/webappsec-referrer-policy#133, by @Malvoz.
-
-
1 pull request merged.
-
Add <script> for `referrerpolicy` content attribute w3c/webappsec-referrer-policy#133.
-
-
1 pull request closed.
-
Stop using environment and request's origin in referrer calculation w3c/webappsec-referrer-policy#129.
-
-
3 pull requests received 12 new comments.
-
Use request's referrer for more things, instead of request's client w3c/webappsec-referrer-policy#135 (9 comments by @domfarolino, @estark37)
-
Add <script> for `referrerpolicy` content attribute w3c/webappsec-referrer-policy#133 (2 comments by @domfarolino, @Malvoz)
-
Stop using environment and request's origin in referrer calculation w3c/webappsec-referrer-policy#129 (1 comment by @domfarolino)
-
w3c/webappsec-change-password-url
-
4 issues opened.
-
What about a link relation type? w3c/webappsec-change-password-url#21, by @dret.
-
Malicious subdomain concern w3c/webappsec-change-password-url#20, by @hober.
-
Expand security considerations section w3c/webappsec-change-password-url#19, by @hober.
-
Migrate to WebAppSec? w3c/webappsec-change-password-url#18, by @hober.
-
-
1 issue closed.
-
Consider ways of differentiating implementation and poor error pages w3c/webappsec-change-password-url#14.
-
-
6 issues received 14 new comments.
-
Migrate to WebAppSec? w3c/webappsec-change-password-url#18 (6 comments by @cwilso, @hober, @mikewest)
-
Malicious subdomain concern w3c/webappsec-change-password-url#20 (3 comments by @rmondello, @tag636, @tschoffelen)
-
What about a link relation type? w3c/webappsec-change-password-url#21 (2 comments by @dret, @tschoffelen)
-
Expand security considerations section w3c/webappsec-change-password-url#19 (1 comment by @nsonaniya2010)
-
Consider ways of differentiating implementation and poor error pages w3c/webappsec-change-password-url#14 (1 comment by @hober)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
Emails field w3c/webappsec-credential-management#146, by @dtruffaut.
-
Update / Delete methods w3c/webappsec-credential-management#145, by @dtruffaut.
-
Participants
-
1 participant joined.
-
Mingqiu Sun (Intel Corporation) joined.
-
-
1 participant left.
-
Alexander Antukh (Opera Software AS) left.
-
-
1 organization left.
-
Opera Software AS left.
-
GitHub
w3c/webcrypto
-
2 issues opened.
-
Why can't I get a file checksum if I'm on http? w3c/webcrypto#238, by @StephenLynx.
-
AES-CBC applies IV to first block only w3c/webcrypto#237, by @fomkin.
-
-
1 issue closed.
-
AES-CBC applies IV to first block only w3c/webcrypto#237.
-
-
3 issues received 22 new comments.
-
Please require a secure origin (Bug 25972) w3c/webcrypto#28 (19 comments by @briandipalma, @MattiasMartens, @mwatson2, @patrickjrm, @StephenLynx, @stevendesu, @X-Ryl669)
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue closed.
-
Remove or replace `vr` in the examples w3c/webappsec-permissions-policy#364.
-
-
7 issues received 22 new comments.
-
Feature-Policy: clipboard-read and clipboard-write w3c/webappsec-permissions-policy#322 (8 comments by @bershanskiy, @dway123, @eduxdream, @jondcoleman, @NicholasHallman)
-
Feature Policy shouldn't be overridable w3c/webappsec-permissions-policy#357 (4 comments by @annevk, @clelland)
-
Renaming Feature Policy w3c/webappsec-permissions-policy#359 (4 comments by @annevk, @clelland, @mikewest)
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (3 comments by @clelland, @ConstableBrew, @gertvdijk)
-
Remove or replace `vr` in the examples w3c/webappsec-permissions-policy#364 (1 comment by @clelland)
-
Where is https://github.com/WICG/feature-policy/blob/gh-pages/features.md#sensor-features w3c/webappsec-permissions-policy#183 (1 comment by @anveshpuli)
-
-
4 pull requests opened.
-
Add document policy use cases w3c/webappsec-permissions-policy#373, by @clelland.
-
Update the document policy explainer w3c/webappsec-permissions-policy#372, by @clelland.
-
Start being more consistent with document policy definitions w3c/webappsec-permissions-policy#371, by @clelland.
-
Update publickey-credentials to be "get-only" policy w3c/webappsec-permissions-policy#370, by @equalsJeffH.
-
-
4 pull requests merged.
-
Update publickey-credentials to be "get-only" policy w3c/webappsec-permissions-policy#370.
-
Add document policy use cases w3c/webappsec-permissions-policy#373.
-
Update the document policy explainer w3c/webappsec-permissions-policy#372.
-
Start being more consistent with document policy definitions w3c/webappsec-permissions-policy#371.
-
w3c/trusted-types
-
1 issue opened.
-
Redefine behaviour for svg script href setter. w3c/trusted-types#275, by @koto.
-
-
1 issue closed.
-
Redefine behaviour for svg script href setter. w3c/trusted-types#275.
-
-
2 issues received 4 new comments.
-
Redefine behaviour for svg script href setter. w3c/trusted-types#275 (3 comments by @iVanlIsh, @koto, @otherdaniel)
-
JavaScript event for tracking (and blocking) policy creation w3c/trusted-types#270 (1 comment by @koto)
-
-
1 pull request merged.
-
Fix #275. w3c/trusted-types#277.
-
w3c/webappsec-csp
-
3 issues opened.
-
Are nonces allowed/supported in frame-src? w3c/webappsec-csp#433, by @viraptor.
-
Clarify that report-uri cannot violate mixed-content w3c/webappsec-csp#432, by @antosart.
-
Why do `base-uri` and `frame-ancestors` have different grammars? w3c/webappsec-csp#431, by @bakkot.
-
-
4 issues received 6 new comments.
-
Why do `base-uri` and `frame-ancestors` have different grammars? w3c/webappsec-csp#431 (2 comments by @annevk, @bakkot)
w3c/webappsec-mixed-content
-
1 issue opened.
-
Form submission warning does not address redirects w3c/webappsec-mixed-content#31, by @annevk.
-
-
2 issues received 7 new comments.
-
Form submission warning does not address redirects w3c/webappsec-mixed-content#31 (6 comments by @annevk, @carlosjoan91, @mikewest)
-
-
1 pull request opened.
-
Include concepts from MIX in MIX2 w3c/webappsec-mixed-content#30, by @carlosjoan91.
-
-
1 pull request merged.
-
Include concepts from MIX in MIX2 w3c/webappsec-mixed-content#30.
-
-
1 pull request received 9 new comments.
-
Include concepts from MIX in MIX2 w3c/webappsec-mixed-content#30 (9 comments by @annevk, @carlosjoan91, @mikewest)
-
w3c/permissions
-
2 issues opened.
-
Can `Permission task source` be exported? w3c/permissions#206, by @yoavweiss.
-
PermissionName not defined as proper IDL block w3c/permissions#205, by @tidoust.
-
-
1 issue closed.
-
Can `Permission task source` be exported? w3c/permissions#206.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Export permission task source w3c/permissions#207, by @yoavweiss.
-
-
1 pull request merged.
-
Export permission task source w3c/permissions#207.
-
-
2 pull requests received 4 new comments.
-
Add CameraDevicePermissionDescriptor for 'camera' permission w3c/permissions#204 (3 comments by @beaufortfrancois, @mounirlamouri)
-
w3c/webappsec-referrer-policy
-
1 issue closed.
-
Clarify priority on five ways of Referrer Policy Delivery w3c/webappsec-referrer-policy#131.
-
-
1 issue received 1 new comment.
-
Clarify priority on five ways of Referrer Policy Delivery w3c/webappsec-referrer-policy#131 (1 comment by @domfarolino)
-
-
1 pull request opened.
-
Rebuild spec w3c/webappsec-referrer-policy#132, by @domfarolino.
-
-
2 pull requests merged.
-
Rebuild spec w3c/webappsec-referrer-policy#132.
-
Add Dominic Farolino as an editor w3c/webappsec-referrer-policy#130.
-
-
2 pull requests received 3 new comments.
-
Default to 'strict-origin-when-cross-origin'. w3c/webappsec-referrer-policy#125 (2 comments by @johnwilander, @kiding)
-
w3c/webappsec-fetch-metadata
-
1 issue closed.
-
Document still contains nested-document and nested-navigate w3c/webappsec-fetch-metadata#55.
-
-
1 issue received 1 new comment.
-
Document still contains nested-document and nested-navigate w3c/webappsec-fetch-metadata#55 (1 comment by @mikewest)
-
w3c/webappsec
-
2 pull requests opened.
-
Add mixed content to 2020-04-21-agenda.md w3c/webappsec#566, by @carlosjoan91.
-
link to minutes in GH w3c/webappsec#565, by @samuelweiler.
-
-
2 pull requests merged.
-
Add mixed content to 2020-04-21-agenda.md w3c/webappsec#566.
-
link to minutes in GH w3c/webappsec#565.
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
secure contexts and Workers created from data URLs w3c/webappsec-secure-contexts#74, by @yutakahirano.
-
-
1 issue received 3 new comments.
-
secure contexts and Workers created from data URLs w3c/webappsec-secure-contexts#74 (3 comments by @annevk, @nhiroki, @yutakahirano)
-
Participants
-
1 participant joined.
-
Matthew Donofrio (Adobe) joined.
-
GitHub
w3c/webappsec-fetch-metadata
-
3 issues opened.
-
Link to Editor's Draft should target actual spec w3c/webappsec-fetch-metadata#57, by @tidoust.
-
`Sec-Fetch-Ancestors`? w3c/webappsec-fetch-metadata#56, by @mikewest.
-
Document still contains nested-document and nested-navigate w3c/webappsec-fetch-metadata#55, by @annevk.
-
-
1 issue received 8 new comments.
-
`Sec-Fetch-Ancestors`? w3c/webappsec-fetch-metadata#56 (8 comments by @annevk, @arturjanc, @deian, @lweichselbaum, @mikewest)
-
w3c/webappsec-csp
-
6 issues opened.
-
Why does hash-source apply to external scripts, but not external styles? w3c/webappsec-csp#430, by @bakkot.
-
connect-src: wss without schema w3c/webappsec-csp#429, by @axelssonHakan.
-
`unsafe-allow-redirects` and `form-action` interact weirdly w3c/webappsec-csp#428, by @bakkot.
-
`javascript:` navigation directive-name is always null w3c/webappsec-csp#427, by @bakkot.
-
Does `strict-dynamic` allow dynamically adding inline scripts? w3c/webappsec-csp#426, by @bakkot.
-
Inconsistent treatment of base64url-encoded hash sources in CSP vs SRI w3c/webappsec-csp#423, by @bakkot.
-
-
3 issues received 11 new comments.
-
connect-src: wss without schema w3c/webappsec-csp#429 (6 comments by @annevk, @axelssonHakan, @bakkot, @mikewest)
-
Does `strict-dynamic` allow dynamically adding inline scripts? w3c/webappsec-csp#426 (4 comments by @arturjanc, @bakkot, @mikewest)
-
Why does hash-source apply to external scripts, but not external styles? w3c/webappsec-csp#430 (1 comment by @mikewest)
-
-
3 pull requests opened.
-
Clarify that integrity metadata must be non-empty w3c/webappsec-csp#425, by @bakkot.
-
Use correct set of source expressions in script directives pre-request check w3c/webappsec-csp#424, by @bakkot.
-
-
1 pull request closed.
-
Fix typo w3c/webappsec-csp#422.
-
w3c/webappsec-permissions-policy
-
1 issue closed.
-
define the term "feature" w3c/webappsec-permissions-policy#309.
-
-
3 issues received 3 new comments.
-
Feature-Policy: clipboard-read and clipboard-write w3c/webappsec-permissions-policy#322 (1 comment by @tomayac)
-
3 pull requests opened.
-
Update Python config w3c/webappsec-permissions-policy#368, by @clelland.
-
update integration.md w3c/webappsec-permissions-policy#367, by @equalsJeffH.
-
Feature registry w3c/webappsec-permissions-policy#366, by @clelland.
-
-
2 pull requests merged.
-
update integration.md w3c/webappsec-permissions-policy#367.
-
Update Python config w3c/webappsec-permissions-policy#368.
-
-
1 pull request received 4 new comments.
w3c/webappsec
-
1 issue received 1 new comment.
-
2 pull requests opened.
-
Update python version for bikeshed w3c/webappsec#564, by @wseltzer.
-
Add mixed content to 2020-03-17 agenda w3c/webappsec#563, by @estark37.
-
-
2 pull requests merged.
-
Update python version for bikeshed w3c/webappsec#564.
-
Add mixed content to 2020-03-17 agenda w3c/webappsec#563.
-
w3c/permissions
-
1 pull request opened.
-
Add CameraDevicePermissionDescriptor for 'camera' permission w3c/permissions#204, by @eehakkin.
-
-
1 pull request merged.
-
Add CameraDevicePermissionDescriptor for 'camera' permission w3c/permissions#204.
-
-
1 pull request received 7 new comments.
-
Add CameraDevicePermissionDescriptor for 'camera' permission w3c/permissions#204 (7 comments by @beaufortfrancois, @eehakkin, @mounirlamouri, @riju)
-
w3c/webappsec-subresource-integrity
-
2 issues received 10 new comments.
-
integrity for downloads w3c/webappsec-subresource-integrity#68 (9 comments by @annevk, @devd, @khuguenin, @Marcono1234, @mozfreddyb, @tdelmas)
-
w3c/webappsec-credential-management
-
1 issue received 1 new comment.
-
Update spec to new IDL syntax for optional dictionaries w3c/webappsec-credential-management#140 (1 comment by @domenic)
-
w3c/trusted-types
-
1 issue opened.
-
JavaScript event for tracking (and blocking) policy creation w3c/trusted-types#270, by @koto.
-
-
16 issues closed.
-
Consider allowing creating a policy via a constructor. w3c/trusted-types#258.
-
Navigating to plugins w3c/trusted-types#234.
-
Putting guards at primitives instead of sinks w3c/trusted-types#176.
-
`TreatNullAs` behavior for `innerHTML`, et al. is unclear. w3c/trusted-types#2.
-
Consider removing getPolicyNames() w3c/trusted-types#235.
-
Document.write and such as names are misleading w3c/trusted-types#260.
-
Use of [Unforgeable] in Trusted Types WebIDL w3c/trusted-types#257.
-
Alternative Options for Default Policy. w3c/trusted-types#248.
-
Cover missing sinks w3c/trusted-types#169.
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117.
-
"require-trusted-types-for Pre-Navigation check" versus "Get Trusted Type compliant string" w3c/trusted-types#246.
-
Possible trustedTypes bypass when assigning to script.innerHTML w3c/trusted-types#238.
-
Facilitate creating trusted types from string literals w3c/trusted-types#96.
-
Polyfilling HostEnsureCanCompileStrings w3c/trusted-types#120.
-
Clarify in spec - JS 'this' in policy.createXXX() w3c/trusted-types#78.
-
Put safeguards around attribute nodes w3c/trusted-types#47.
-
-
1 issue reopened.
-
Consider allowing creating a policy via a constructor. w3c/trusted-types#258, by @koto.
-
-
19 issues received 31 new comments.
-
Consider allowing creating a policy via a constructor. w3c/trusted-types#258 (9 comments by @koto, @mikewest, @otherdaniel, @othermaciej)
-
Document.write and such as names are misleading w3c/trusted-types#260 (5 comments by @annevk, @domenic, @koto)
-
JavaScript event for tracking (and blocking) policy creation w3c/trusted-types#270 (1 comment by @koto)
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (1 comment by @koto)
-
`TreatNullAs` behavior for `innerHTML`, et al. is unclear. w3c/trusted-types#2 (1 comment by @mikewest)
-
Allow guarding (dynamic) module imports - a type for module specifiers w3c/trusted-types#117 (1 comment by @koto)
-
Possible trustedTypes bypass when assigning to script.innerHTML w3c/trusted-types#238 (1 comment by @koto)
-
-
12 pull requests opened.
-
'require-trusted-types-for' works only in secure contexts. w3c/trusted-types#274, by @koto.
-
Adding TT to Worker constructors, Service Workers registration w3c/trusted-types#272, by @koto.
-
Added integration with WebIDL + relevant HTML callout. w3c/trusted-types#271, by @koto.
-
Deprecated TrustedURLs in the polyfill. w3c/trusted-types#269, by @koto.
-
Added support for trusted-types * to the polyfill. w3c/trusted-types#268, by @koto.
-
Added support for 'trusted-types *' to align better with other CSP directives. w3c/trusted-types#267, by @koto.
-
Added [SecureContext] to new interfaces. w3c/trusted-types#266, by @koto.
-
Added security consideration section about navigating plugins w3c/trusted-types#265, by @koto.
-
Removing `getPolicyNames`. w3c/trusted-types#264, by @koto.
-
Always use the constructor name instead of Element local names. w3c/trusted-types#261, by @koto.
-
-
12 pull requests merged.
-
'require-trusted-types-for' works only in secure contexts. w3c/trusted-types#274.
-
Adding TT to Worker constructors, Service Workers registration w3c/trusted-types#272.
-
Added integration with WebIDL + relevant HTML callout. w3c/trusted-types#271.
-
Deprecated TrustedURLs in the polyfill. w3c/trusted-types#269.
-
Added support for trusted-types * to the polyfill. w3c/trusted-types#268.
-
Added support for 'trusted-types *' to align better with other CSP directives. w3c/trusted-types#267.
-
Added [SecureContext] to new interfaces. w3c/trusted-types#266.
-
Added security consideration section about navigating plugins w3c/trusted-types#265.
-
Removing `getPolicyNames`. w3c/trusted-types#264.
-
Fix #260. w3c/trusted-types#263.
-
Fix #257 w3c/trusted-types#262.
-
Always use the constructor name instead of Element local names. w3c/trusted-types#261.
-
-
1 pull request received 1 new comment.
-
w3c/trusted-types#273 (1 comment by @wseltzer)
-
w3c/webcrypto
-
2 issues closed.
-
Update references w3c/webcrypto#229.
-
[SecureContext] not defined by old WebIDL reference w3c/webcrypto#232.
-
-
1 pull request opened.
-
fix hashAlglorithm typo w3c/webcrypto#236, by @panva.
-
-
2 pull requests merged.
-
fix hashAlglorithm typo w3c/webcrypto#236.
-
Convert editors draft to ReSpec w3c/webcrypto#234.
-
-
2 pull requests received 2 new comments.
w3c/webappsec-mixed-content
-
1 pull request opened.
-
Fix "requires prohibits" w3c/webappsec-mixed-content#29, by @jyasskin.
-
-
1 pull request merged.
-
Add FPWD document for MIX2 w3c/webappsec-mixed-content#24.
-
-
1 pull request received 1 new comment.
w3c/webappsec-referrer-policy
-
1 issue received 12 new comments.
-
Inconsistencies with "same-origin" requests w3c/webappsec-referrer-policy#123 (12 comments by @annevk, @bzbarsky, @domenic, @domfarolino)
-
-
1 pull request received 1 new comment.
-
Stop using environment and request's origin in referrer calculation w3c/webappsec-referrer-policy#129 (1 comment by @domfarolino)
-
Participants
-
3 participants joined.
-
Jungkee Song (Microsoft Corporation) joined.
-
Jun Kokatsu (Microsoft Corporation) joined.
-
Dirk Balfanz (Google LLC) joined.
-
-
2 participants left.
-
Eduardo Alberto Vela Nava (Google LLC) left.
-
Adam Barth (Google LLC) left.
-
GitHub
w3c/webcrypto
-
1 issue opened.
-
HashAlgorithmIdentifier refers another typedef name AlgorithmIdentifier w3c/webcrypto#235, by @peria.
-
-
4 issues received 6 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (1 comment by @rabindranathfv)
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Use Purge Service Worker Registrations for storage w3c/webappsec-clear-site-data#63, by @jungkees.
-
-
1 pull request received 1 new comment.
-
Use Purge Service Worker Registrations for storage w3c/webappsec-clear-site-data#63 (1 comment by @jungkees)
-
w3c/trusted-types
-
4 issues opened.
-
Document.write and such as names are misleading w3c/trusted-types#260, by @annevk.
-
Restrict to secure contexts w3c/trusted-types#259, by @annevk.
-
Consider allowing creating a policy via a constructor. w3c/trusted-types#258, by @koto.
-
Use of [Unforgeable] in Trusted Types WebIDL w3c/trusted-types#257, by @littledan.
-
-
6 issues received 22 new comments.
-
Use of [Unforgeable] in Trusted Types WebIDL w3c/trusted-types#257 (12 comments by @annevk, @domenic, @koto, @littledan)
-
Document.write and such as names are misleading w3c/trusted-types#260 (2 comments by @annevk, @koto)
-
Consider allowing creating a policy via a constructor. w3c/trusted-types#258 (2 comments by @koto, @otherdaniel)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Should we ignore invalid values? w3c/webappsec-fetch-metadata#54, by @sspi.
-
-
2 issues received 3 new comments.
-
Why is `Sec-Fetch-Site` based on the full URL redirect chain? w3c/webappsec-fetch-metadata#28 (1 comment by @annevk)
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
SubResourceIntegrity check failed for <link> tag w3c/webappsec-subresource-integrity#91, by @manoj6587.
-
-
1 issue closed.
-
SubResourceIntegrity check failed for <link> tag w3c/webappsec-subresource-integrity#91.
-
-
3 issues received 16 new comments.
-
Consider shared caching w3c/webappsec-subresource-integrity#22 (9 comments by @annevk, @ArneBab, @MatthewSteeples)
-
SubResourceIntegrity check failed for <link> tag w3c/webappsec-subresource-integrity#91 (1 comment by @dveditz)
-
-
1 pull request received 1 new comment.
-
Apply integrity checks to inline script and style blocks. w3c/webappsec-subresource-integrity#86 (1 comment by @ghost)
-
w3c/webappsec-csp
-
1 issue opened.
-
Inconsistent behavior of frame-ancestors versus implementations w3c/webappsec-csp#421, by @iangcarroll.
-
-
1 issue received 4 new comments.
-
Include script hash in CSP report when 'report-sample' is set w3c/webappsec-csp#378 (4 comments by @freddieleeman, @mikewest, @SniperSister, @zero-24)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Remove or replace `vr` in the examples w3c/webappsec-permissions-policy#364, by @Malvoz.
-
-
1 issue received 2 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (2 comments by @oliverjanik, @Valodim)
-
-
1 pull request opened.
-
Update document policy privacy + security w3c/webappsec-permissions-policy#363, by @clelland.
-
-
1 pull request merged.
-
Update document policy privacy + security w3c/webappsec-permissions-policy#363.
-
-
1 pull request closed.
-
Add `document-access` to proposed features w3c/webappsec-permissions-policy#351.
-
w3c/webappsec
-
1 issue received 1 new comment.
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Convoluted blob: URL issue w3c/webappsec-secure-contexts#71, by @annevk.
-
-
4 issues closed.
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28.
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9.
-
Typo: "Intergration with WebIDL" w3c/webappsec-secure-contexts#59.
-
Can data: URLs be part of a secure context? w3c/webappsec-secure-contexts#69.
-
-
5 issues received 10 new comments.
-
Can data: URLs be part of a secure context? w3c/webappsec-secure-contexts#69 (5 comments by @annevk, @mikewest)
-
Consider whether sandboxed content should automatically be a secure context w3c/webappsec-secure-contexts#28 (2 comments by @annevk, @mikewest)
-
Figure out how to manage normative dependencies to WHATWG HTML for features not in W3C HTML for CR/REC w3c/webappsec-secure-contexts#9 (1 comment by @annevk)
-
Sandboxed data: URI in a localhost page should be a Secure Context w3c/webappsec-secure-contexts#26 (1 comment by @annevk)
-
-
3 pull requests opened.
-
Drop the sandbox flag. w3c/webappsec-secure-contexts#73, by @mikewest.
-
data: URLs w3c/webappsec-secure-contexts#72, by @annevk.
-
Meta: address Bikeshed issues w3c/webappsec-secure-contexts#70, by @annevk.
-
-
3 pull requests merged.
-
Drop the sandbox flag. w3c/webappsec-secure-contexts#73.
-
Fix typo in WebIDL header w3c/webappsec-secure-contexts#67.
-
data: URLs w3c/webappsec-secure-contexts#72.
-
-
1 pull request closed.
-
Meta: address Bikeshed issues w3c/webappsec-secure-contexts#70.
-
-
2 pull requests received 2 new comments.
w3c/webappsec-referrer-policy
-
1 pull request received 2 new comments.
-
Strip referrer information from non-secure requests. w3c/webappsec-referrer-policy#126 (2 comments by @ericlaw1979, @fmarier)
-
w3c/permissions
-
1 issue received 1 new comment.
-
Consider making `request-permission-to-use` aware of user activation w3c/permissions#194 (1 comment by @reillyeon)
-
TR publications
-
1 document published.
-
Fetch Metadata Request Headers published as a Working Draft. History of Fetch Metadata Request Headers
-
Participants
-
1 participant left.
-
Jochen Eisinger (Google LLC) left.
-
GitHub
w3c/trusted-types
-
2 issues opened.
-
require-trusted-types-for 'wasm' w3c/trusted-types#256, by @lweichselbaum.
-
Spec source file uses "section autolinks" incorrectly, they'll start breaking w3c/trusted-types#254, by @tabatkins.
-
-
1 issue closed.
-
Spec source file uses "section autolinks" incorrectly, they'll start breaking w3c/trusted-types#254.
-
-
1 issue reopened.
-
Specify no Trusted Type Policies allowed w3c/trusted-types#253, by @koto.
-
-
4 issues received 8 new comments.
-
Alternative Options for Default Policy. w3c/trusted-types#248 (3 comments by @annevk, @koto, @otherdaniel)
-
Spec source file uses "section autolinks" incorrectly, they'll start breaking w3c/trusted-types#254 (1 comment by @koto)
-
-
1 pull request merged.
-
Fix #254. w3c/trusted-types#255.
-
w3c/webcrypto
-
2 issues opened.
-
support for Curve25519 in WebCrypto. w3c/webcrypto#233, by @dontcallmedom.
-
[SecureContext] not defined by old WebIDL reference w3c/webcrypto#232, by @Jon-Work.
-
-
1 pull request opened.
-
Convert editors draft to ReSpec w3c/webcrypto#234, by @dontcallmedom.
-
-
1 pull request received 1 new comment.
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Spec source file uses "section autolinks" incorrectly, they'll start breaking w3c/webappsec-permissions-policy#361, by @tabatkins.
-
-
6 issues received 7 new comments.
-
Extend "allow" attribute on iframes to support complete syntax w3c/webappsec-permissions-policy#78 (2 comments by @craigfrancis, @jdalton)
-
Feature Policy shouldn't be overridable w3c/webappsec-permissions-policy#357 (1 comment by @jpchase)
-
Spec source file uses "section autolinks" incorrectly, they'll start breaking w3c/webappsec-permissions-policy#361 (1 comment by @clelland)
-
-
1 pull request opened.
-
Remove obsolete speaker policy w3c/webappsec-permissions-policy#360, by @jpchase.
-
-
1 pull request merged.
-
Remove obsolete speaker policy w3c/webappsec-permissions-policy#360.
-
-
1 pull request received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
Where's the right repository for reporting an issue of the doc of w3.org? w3c/webappsec#562, by @moonformeli.
-
-
1 issue closed.
-
Where's the right repository for reporting an issue of the doc of w3.org? w3c/webappsec#562.
-
-
1 issue received 2 new comments.
-
Where's the right repository for reporting an issue of the doc of w3.org? w3c/webappsec#562 (2 comments by @annevk, @moonformeli)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Clarify priority on five ways of Referrer Policy Delivery w3c/webappsec-referrer-policy#131, by @sulume.
-
-
1 issue received 1 new comment.
-
Clarify priority on five ways of Referrer Policy Delivery w3c/webappsec-referrer-policy#131 (1 comment by @domfarolino)
-
-
1 pull request received 1 new comment.
w3c/webappsec-fetch-metadata
-
1 issue received 1 new comment.
-
`Sec-Fetch-Site` for requests from extension background pages w3c/webappsec-fetch-metadata#47 (1 comment by @arturjanc)
-
-
1 pull request opened.
-
Meta: generate HTML w3c/webappsec-fetch-metadata#53, by @annevk.
-
-
1 pull request received 1 new comment.
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Specify hash function naming w3c/webappsec-subresource-integrity#89, by @fulldecent.
-
-
1 issue closed.
-
Specify hash function naming w3c/webappsec-subresource-integrity#89.
-
-
3 issues received 9 new comments.
-
Specify hash function naming w3c/webappsec-subresource-integrity#89 (5 comments by @devd, @jonathanKingston)
-
Consideration: Allow integrity-check based on signature instead of actual hash w3c/webappsec-subresource-integrity#85 (3 comments by @devd, @fulldecent, @NL-William)
-
The algorithm for parsing metadata should be described in more detail w3c/webappsec-subresource-integrity#84 (1 comment by @annevk)
-
-
3 pull requests opened.
-
Reword SHA384 non-normative reference to SHA-384 hash function refere… w3c/webappsec-subresource-integrity#90, by @jonathanKingston.
-
Correct spelling for other GitHub w3c/webappsec-subresource-integrity#88, by @fulldecent.
-
Correct spelling of GitHub w3c/webappsec-subresource-integrity#87, by @fulldecent.
-
-
2 pull requests merged.
-
Reword SHA384 non-normative reference to SHA-384 hash function refere… w3c/webappsec-subresource-integrity#90.
-
Correct spelling of GitHub w3c/webappsec-subresource-integrity#87.
-
-
1 pull request reopened.
-
Apply integrity checks to inline script and style blocks. w3c/webappsec-subresource-integrity#86, by @annevk.
-
-
4 pull requests received 19 new comments.
-
Apply integrity checks to inline script and style blocks. w3c/webappsec-subresource-integrity#86 (10 comments by @annevk, @arturjanc, @mikewest)
-
Correct spelling for other GitHub w3c/webappsec-subresource-integrity#88 (4 comments by @devd, @fulldecent, @wseltzer)
-
Reword SHA384 non-normative reference to SHA-384 hash function refere… w3c/webappsec-subresource-integrity#90 (3 comments by @annevk, @devd)
-
w3c/webappsec-change-password-url
-
1 issue received 2 new comments.
-
1 pull request opened.
-
Update WELLKNOWN RFC to RFC8615 w3c/webappsec-change-password-url#17, by @gvangool.
-
-
1 pull request merged.
-
Update WELLKNOWN RFC to RFC8615 w3c/webappsec-change-password-url#17.
-
-
1 pull request received 1 new comment.
w3c/webappsec-csp
-
3 issues opened.
-
Why does plugin-types use the empty list instead of 'none'? w3c/webappsec-csp#420, by @bakkot.
-
Where is the Content Security Policy Directive registry? w3c/webappsec-csp#419, by @bakkot.
-
-
3 issues received 3 new comments.
-
Why does plugin-types use the empty list instead of 'none'? w3c/webappsec-csp#420 (1 comment by @craigfrancis)
-
Where is the Content Security Policy Directive registry? w3c/webappsec-csp#419 (1 comment by @sideshowbarker)
-
Spec is inconsistent about which strings are valid CSPs w3c/webappsec-csp#414 (1 comment by @lucasgadani)
-
-
1 pull request received 1 new comment.
-
Drop mention of obsolete require-sri-for directive w3c/webappsec-csp#417 (1 comment by @dontcallmedom)
-
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Can data: URLs be part of a secure context? w3c/webappsec-secure-contexts#69, by @annevk.
-
-
1 issue received 5 new comments.
-
Can data: URLs be part of a secure context? w3c/webappsec-secure-contexts#69 (5 comments by @annevk, @bzbarsky)
-