Web Application Security Working Group - Activity in 2024
No matches.
TR publications
-
4 documents published.
-
Permissions published twice as a Working Draft. History of Permissions
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
3 participants joined.
-
Tom Schuster (Mozilla Foundation) joined.
-
Tom Ritter (Mozilla Foundation) joined.
-
Lawson Jaglom-Kurtz (Shopify) joined.
-
GitHub
w3c/webcrypto
-
5 issues opened.
-
Add `raw-private` (and possibly `raw-public` and `raw-secret`) key formats? w3c/webcrypto#393, by @twiss.
-
Possibly missing step in HMAC key generation operation w3c/webcrypto#392, by @devgianlu.
-
Reconsider "in parallel"? w3c/webcrypto#389, by @annevk.
-
Unclear HMAC generateKey behavior w3c/webcrypto#387, by @devgianlu.
-
RFE: TLS API w3c/webcrypto#385, by @CendioOssman.
-
-
7 issues closed.
-
Possibly missing step in HMAC key generation operation w3c/webcrypto#392.
-
Define return types of SubtleCrypto methods with more specific types w3c/webcrypto#293.
-
Missing tasks in parallel steps in Web Cryptography API w3c/webcrypto#368.
-
Unclear HMAC generateKey behavior w3c/webcrypto#387.
-
RFE: TLS API w3c/webcrypto#385.
-
Null check operator used on a null value w3c/webcrypto#355.
-
Selected ECC curves are not secure w3c/webcrypto#196.
-
-
7 issues received 35 new comments.
-
Missing tasks in parallel steps in Web Cryptography API w3c/webcrypto#368 (16 comments by @annevk, @davidben, @dlongley, @dontcallmedom, @twiss)
-
Possibly missing step in HMAC key generation operation w3c/webcrypto#392 (2 comments by @devgianlu, @twiss)
-
Support for PQC algorithms: ML-KEM, ML-DSA and SLH-DSA ? w3c/webcrypto#367 (1 comment by @paulmillr)
-
-
5 pull requests opened.
-
Add missing algorithm `length` property in HMAC key generation w3c/webcrypto#394, by @twiss.
-
Fix RSA-OAEP and RSA-PSS typos for JWK w3c/webcrypto#391, by @devgianlu.
-
Accept (async) iterables in `crypto.subtle.digest` w3c/webcrypto#390, by @twiss.
-
Make return types of SubtleCrypto methods more specific w3c/webcrypto#388, by @twiss.
-
Queue tasks to resolve or reject promises w3c/webcrypto#386, by @twiss.
-
-
5 pull requests merged.
-
Add missing algorithm `length` property in HMAC key generation w3c/webcrypto#394.
-
Fix RSA-OAEP and RSA-PSS typos for JWK w3c/webcrypto#391.
-
Make return types of SubtleCrypto methods more specific w3c/webcrypto#388.
-
Queue tasks to resolve or reject promises w3c/webcrypto#386.
-
Add Curve25519 w3c/webcrypto#362.
-
-
4 pull requests received 20 new comments.
-
Queue tasks to resolve or reject promises w3c/webcrypto#386 (14 comments by @annevk, @dontcallmedom, @twiss)
-
Make return types of SubtleCrypto methods more specific w3c/webcrypto#388 (3 comments by @annevk, @twiss)
-
w3c/trusted-types
-
6 issues opened.
-
Examine tests which are commented out in <GlobalEventHandlers-onclick.html> w3c/trusted-types#571, by @ghost.
-
Add tests for `setAttribute`/`setAttributeNS`'s sink names w3c/trusted-types#570, by @ghost.
-
mXSS: should `createHTML` get information about the context? w3c/trusted-types#569, by @mozfreddyb.
-
Add tests for setInterval()/setTimeout() called from WorkerGlobalScope w3c/trusted-types#568, by @fred-wang.
-
Add tests for worker constructors called from worker global scope w3c/trusted-types#567, by @fred-wang.
-
Rely on WedIDL's "implements" definition for isHTML/isScript/isScriptURL? w3c/trusted-types#566, by @fred-wang.
-
-
6 issues closed.
-
Add tests for worker constructors called from worker global scope w3c/trusted-types#567.
-
Improve test coverage for DOM integration in WPT w3c/trusted-types#425.
-
Add test for `setAttributeNS` with an event handler w3c/trusted-types#448.
-
Duplication of some tests w3c/trusted-types#426.
-
<Element-setAttributeNS.html> contains commented out test and seems to duplicate other tests w3c/trusted-types#447.
-
-
7 issues received 13 new comments.
-
mXSS: should `createHTML` get information about the context? w3c/trusted-types#569 (5 comments by @lukewarlow, @mozfreddyb, @Sora2455)
-
Add tests for worker constructors called from worker global scope w3c/trusted-types#567 (2 comments by @ghost)
-
Rely on WedIDL's "implements" definition for isHTML/isScript/isScriptURL? w3c/trusted-types#566 (2 comments by @ghost)
-
<Element-setAttributeNS.html> contains commented out test and seems to duplicate other tests w3c/trusted-types#447 (1 comment by @ghost)
-
w3c/webappsec-dbsc
-
2 issues opened.
-
Intent to Migrate: Device Bound Session Credentials w3c/webappsec-dbsc#83, by @drubery.
-
navigator.secureSession is undefined on Chrome 132 w3c/webappsec-dbsc#82, by @CamiloGarciaLaRotta.
-
-
14 issues closed.
-
In startsession we deliver authorization artifact in two different ways w3c/webappsec-dbsc#19.
-
Cluttering the TPM and potential denial of service ? w3c/webappsec-dbsc#20.
-
non-TPM devices? Android and iPhone / iOS | iPadOS TPM equivalents? w3c/webappsec-dbsc#21.
-
Really supportive of this effort! w3c/webappsec-dbsc#22.
-
What is the expectation of multi-site cross-site signatures? w3c/webappsec-dbsc#40.
-
iat is a number w3c/webappsec-dbsc#42.
-
JWTs are not themselves base64url encoded w3c/webappsec-dbsc#47.
-
Refresh session performance 1: Waiting for response from the server. w3c/webappsec-dbsc#60.
-
Refresh session performance 2: Fresh nonce prefetching. w3c/webappsec-dbsc#61.
-
Use Outside of Google w3c/webappsec-dbsc#62.
-
Is there a timeline for when DBSC will be available on OSX and other OSs? w3c/webappsec-dbsc#64.
-
PoC using swtpm w3c/webappsec-dbsc#63.
-
navigator.secureSession is undefined on Chrome 132 w3c/webappsec-dbsc#82.
-
Unclear request method for `/securesession/refresh` w3c/webappsec-dbsc#78.
-
-
1 issue reopened.
-
Use Outside of Google w3c/webappsec-dbsc#62, by @kmonsen.
-
-
19 issues received 23 new comments.
-
Support for Software Defined Authenticators and Credential Managers w3c/webappsec-dbsc#80 (2 comments by @davidldennison, @kmonsen)
-
Details on Session Identifier are not clear in the Explainer w3c/webappsec-dbsc#55 (2 comments by @drubery, @kmonsen)
-
navigator.secureSession is undefined on Chrome 132 w3c/webappsec-dbsc#82 (2 comments by @drubery, @jcat4)
-
non-TPM devices? Android and iPhone / iOS | iPadOS TPM equivalents? w3c/webappsec-dbsc#21 (1 comment by @kmonsen)
-
[Fetch] What's stopping us from using the Fetch API configuration to support this? w3c/webappsec-dbsc#39 (1 comment by @kmonsen)
-
What is the expectation of multi-site cross-site signatures? w3c/webappsec-dbsc#40 (1 comment by @kmonsen)
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56 (1 comment by @kmonsen)
-
Refresh session performance 1: Waiting for response from the server. w3c/webappsec-dbsc#60 (1 comment by @kmonsen)
-
Refresh session performance 2: Fresh nonce prefetching. w3c/webappsec-dbsc#61 (1 comment by @kmonsen)
-
Is there a timeline for when DBSC will be available on OSX and other OSs? w3c/webappsec-dbsc#64 (1 comment by @kmonsen)
-
-
3 pull requests opened.
-
Revert "Update explainer with threat and device specs" w3c/webappsec-dbsc#86, by @kmonsen.
-
Expand on the threat model in goals/non-goals. w3c/webappsec-dbsc#85, by @danmarg.
-
Update explainer with threat and device specs w3c/webappsec-dbsc#84, by @kmonsen.
-
-
4 pull requests merged.
-
Fix typo in README w3c/webappsec-dbsc#77.
-
Expand on the threat model in goals/non-goals. w3c/webappsec-dbsc#85.
-
Revert "Update explainer with threat and device specs" w3c/webappsec-dbsc#86.
-
Update explainer with threat and device specs w3c/webappsec-dbsc#84.
-
-
1 pull request received 1 new comment.
w3c/permissions
-
1 issue opened.
-
Bring this document to CR w3c/permissions#454, by @jyasskin.
-
-
5 issues closed.
-
Conditional permissions w3c/permissions#189.
-
Automation: Need two more steps to handle closed browsing context and user prompts w3c/permissions#347.
-
Automation: "set permission" granularity w3c/permissions#348.
-
Automation: "Get Permission" w3c/permissions#349.
-
describe implicitly-granted (chooser-based) permissions w3c/permissions#178.
-
-
1 issue reopened.
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153, by @jyasskin.
-
-
9 issues received 19 new comments.
-
Bring this document to CR w3c/permissions#454 (5 comments by @marcoscaceres, @miketaylr, @mikewest, @simoneonofri)
-
Allow Permissions Policy-based permission models w3c/permissions#185 (3 comments by @jan-ivar, @jyasskin, @marcoscaceres)
-
"Requesting more permission" algorithms are tightly coupled to prompts w3c/permissions#153 (3 comments by @jyasskin, @marcoscaceres)
-
describe implicitly-granted (chooser-based) permissions w3c/permissions#178 (2 comments by @marcoscaceres, @miketaylr)
-
Permission query algorithm should be able to fail w3c/permissions#135 (2 comments by @marcoscaceres, @miketaylr)
-
Automation: Need two more steps to handle closed browsing context and user prompts w3c/permissions#347 (1 comment by @marcoscaceres)
-
-
2 pull requests opened.
-
Editorial: Prepare for CR w3c/permissions#457, by @marcoscaceres.
-
Use `<code>` for references to a CDDL type w3c/permissions#455, by @tidoust.
-
-
2 pull requests merged.
-
Editorial: Fix sentences around permission states w3c/permissions#452.
-
Use `<code>` for references to a CDDL type w3c/permissions#455.
-
-
1 pull request closed.
-
Export permissions task source w3c/permissions#407.
-
-
5 pull requests received 5 new comments.
-
w3c/permissions#456 (1 comment by @w3cbot)
w3c/webappsec-permissions-policy
-
1 issue opened.
-
W3C ODRL w3c/webappsec-permissions-policy#557, by @riannella.
-
w3c/webappsec-csp
-
4 issues opened.
-
How to prevent an iframe with srcdoc and defined csp from inheriting the parent page's CSP policies w3c/webappsec-csp#700, by @JuanRojasC.
-
EnsureCSPDoesNotBlockStringCompilation: calling "Get Trusted Type compliant string" w3c/webappsec-csp#698, by @fred-wang.
-
https://w3c.github.io/webappsec-csp/#report-violation invokes "Queue a task" without passing a task source w3c/webappsec-csp#696, by @ghost.
-
-
1 issue closed.
-
EnsureCSPDoesNotBlockStringCompilation uses incorrect compilationSink for Eval w3c/webappsec-csp#695.
-
-
5 issues received 6 new comments.
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683 (2 comments by @dveditz)
-
Initializing a document's CSP list requires synchronous cross-process access w3c/webappsec-csp#389 (1 comment by @antosart)
-
How to prevent an iframe with srcdoc and defined csp from inheriting the parent page's CSP policies w3c/webappsec-csp#700 (1 comment by @arturjanc)
-
Assigning `location.href` to a `javascript:...` is a form of eval w3c/webappsec-csp#688 (1 comment by @dinofx)
-
EnsureCSPDoesNotBlockStringCompilation uses incorrect compilationSink for Eval w3c/webappsec-csp#695 (1 comment by @lukewarlow)
-
-
1 pull request opened.
-
Fix eval compilationSink in EnsureCSPDoesNotBlockStringCompilation. w3c/webappsec-csp#699, by @fred-wang.
-
-
3 pull requests merged.
-
Fix eval compilationSink in EnsureCSPDoesNotBlockStringCompilation. w3c/webappsec-csp#699.
-
Fix match-ports to handle a null input port w3c/webappsec-csp#435.
-
Hash reporting for scripts w3c/webappsec-csp#693.
-
-
3 pull requests received 36 new comments.
-
Hash reporting for scripts w3c/webappsec-csp#693 (32 comments by @annevk, @antosart, @ddworken, @dveditz, @mikewest, @yoavweiss)
-
Fix match-ports to handle a null input port w3c/webappsec-csp#435 (3 comments by @annevk, @antosart)
-
Fix eval compilationSink in EnsureCSPDoesNotBlockStringCompilation. w3c/webappsec-csp#699 (1 comment by @fred-wang)
-
w3c/webappsec
-
2 issues closed.
-
Planning 2024-11-20. w3c/webappsec#662.
-
Planning 2024-06-19 w3c/webappsec#652.
-
-
3 issues received 3 new comments.
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Consider integrity check violation reporting w3c/webappsec-subresource-integrity#20 (1 comment by @ddworken)
-
w3c/webappsec-cspee
-
1 issue opened.
-
Redirect https://w3c.github.io/webappsec-csp/embedded/ w3c/webappsec-cspee#30, by @annevk.
-
TR publications
-
4 documents published.
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Trusted Types published 3 times as a Working Draft. History of Trusted Types
-
Past meetings
-
1 meeting.
Participants
-
2 participants joined.
-
Filip Skokan (Okta) joined.
-
Kaushik Satpathy (Yahoo Holdings Inc.) joined.
-
GitHub
w3c/trusted-types
-
1 issue opened.
-
Endless loop of `DOMParser.parseFromString` when used with Trusted Types polyfill w3c/trusted-types#563, by @orazioedoardo.
-
-
5 issues closed.
-
Endless loop of `DOMParser.parseFromString` when used with Trusted Types polyfill w3c/trusted-types#563.
-
"Get Trusted Type compliant string" is called with "script" instead of "'script'" w3c/trusted-types#542.
-
Does the DOM spec really need to special case script elements for replaceChildren etc. w3c/trusted-types#537.
-
https://html.spec.whatwg.org/#dom-range-createcontextualfragment should pass "'script'" w3c/trusted-types#543.
-
-
1 issue reopened.
-
SVGScriptElement needs TT protection too w3c/trusted-types#483, by @annevk.
-
-
6 issues received 9 new comments.
-
Endless loop of `DOMParser.parseFromString` when used with Trusted Types polyfill w3c/trusted-types#563 (2 comments by @koto, @orazioedoardo)
-
Add test to <block-string-assignment-to-Element-setAttribute.html> which checks trusted types can be assigned to non-injection sinks w3c/trusted-types#449 (2 comments by @ghost)
-
Does the DOM spec really need to special case script elements for replaceChildren etc. w3c/trusted-types#537 (2 comments by @fred-wang, @lukewarlow)
-
Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`? w3c/trusted-types#534 (1 comment by @ghost)
-
-
4 pull requests opened.
-
Revert "Change Script Enforcement Mechanism to use flags" w3c/trusted-types#565, by @koto.
-
Put trusted type first when declaring union in IDL files w3c/trusted-types#564, by @fred-wang.
-
Remove link to https://github.com/whatwg/dom/pull/1258 w3c/trusted-types#562, by @fred-wang.
-
Sink group should be single-quoted only in CSP syntax. w3c/trusted-types#561, by @koto.
-
-
5 pull requests merged.
-
Revert "Change Script Enforcement Mechanism to use flags" w3c/trusted-types#565.
-
Put trusted type first when declaring union in IDL files w3c/trusted-types#564.
-
Sink group should be single-quoted only in CSP syntax. w3c/trusted-types#561.
-
Remove link to https://github.com/whatwg/dom/pull/1258 w3c/trusted-types#562.
-
Replace 'has type' with less confusing 'is an instance of'. w3c/trusted-types#559.
-
-
5 pull requests received 16 new comments.
-
Change Script Enforcement Mechanism to use flags w3c/trusted-types#533 (8 comments by @domfarolino, @koto, @lukewarlow)
-
Put trusted type first when declaring union in IDL files w3c/trusted-types#564 (4 comments by @fred-wang, @lukewarlow)
-
Remove link to https://github.com/whatwg/dom/pull/1258 w3c/trusted-types#562 (2 comments by @fred-wang)
-
Disallow empty policy names on creation. w3c/trusted-types#560 (1 comment)
-
Replace 'has type' with less confusing 'is an instance of'. w3c/trusted-types#559 (1 comment by @ghost)
-
w3c/webappsec-csp
-
5 issues opened.
-
EnsureCSPDoesNotBlockStringCompilation uses incorrect compilationSink for Eval w3c/webappsec-csp#695, by @fred-wang.
-
Allow RFC3986 scheme relative URIs in host-source w3c/webappsec-csp#694, by @Mahoney.
-
Consider recommending the usage of events instead of CSP reports for CSP WPTs w3c/webappsec-csp#690, by @ghost.
-
Assigning `location.href` to a `javascript:...` is a form of eval w3c/webappsec-csp#688, by @dinofx.
-
-
1 issue closed.
-
4 issues received 19 new comments.
-
Assigning `location.href` to a `javascript:...` is a form of eval w3c/webappsec-csp#688 (12 comments by @annevk, @arturjanc, @dinofx)
-
Getting "Refused to execute inline script because it violates the following Content Security Policy directive:" Error w3c/webappsec-csp#689 (5 comments by @antosart, @JyotiPMallick)
-
allow calls to new Function(); - but not to the actual constructed function. under csp unsafe-eval. w3c/webappsec-csp#229 (1 comment by @fcano-ut)
-
Initializing a document's CSP list requires synchronous cross-process access w3c/webappsec-csp#389 (1 comment by @ghost)
-
-
3 pull requests opened.
-
Hash reporting for scripts w3c/webappsec-csp#693, by @yoavweiss.
-
[editorial] Fix wrong references to parse a serialized CSP list w3c/webappsec-csp#691, by @antosart.
-
-
1 pull request merged.
-
[editorial] Fix wrong references to parse a serialized CSP list w3c/webappsec-csp#691.
-
-
2 pull requests received 70 new comments.
-
Hash reporting for scripts w3c/webappsec-csp#693 (67 comments by @annevk, @antosart, @ddworken, @jonathanKingston, @mozfreddyb, @yoavweiss)
-
Use "navigation request's policy container's CSP list" instead of "navigation request's client's global object's CSP list" w3c/webappsec-csp#692 (3 comments by @antosart, @ghost)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
CORS integration w3c/webappsec-dbsc#81, by @annevk.
-
-
2 issues received 7 new comments.
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56 (1 comment by @bc-pi)
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Apply subresource integrity to <img> tags w3c/webappsec-subresource-integrity#113 (1 comment by @edsu)
-
-
1 pull request received 1 new comment.
-
Update references and clarify section 3.5 in the current version of the spec w3c/webappsec-subresource-integrity#112 (1 comment by @domfarolino)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
InvalidStateError for non-fully active documents conflicts with WebAuthn's InvalidStateError w3c/webappsec-credential-management#266, by @nsatragno.
-
-
1 issue received 1 new comment.
-
InvalidStateError for non-fully active documents conflicts with WebAuthn's InvalidStateError w3c/webappsec-credential-management#266 (1 comment by @nsatragno)
-
w3c/webcrypto
-
1 issue opened.
-
Extractable property not set in `SubtleCrypto.deriveKey` w3c/webcrypto#383, by @gmta.
-
-
2 issues closed.
-
Extractable property not set in `SubtleCrypto.deriveKey` w3c/webcrypto#383.
-
Interop issue with HKDF deriveBits operation when length is zero w3c/webcrypto#370.
-
-
2 issues received 17 new comments.
-
Bug 27755 - Using the Subtle Crypto Interface with Streams w3c/webcrypto#73 (16 comments by @bradisbell, @davidben, @dead-claudia, @ghost, @jasnell, @knightcode, @taralx, @twiss)
-
-
1 pull request opened.
-
set [[usages]] and [[extractable]] in the deriveKey method w3c/webcrypto#384, by @panva.
-
-
2 pull requests merged.
-
set [[usages]] and [[extractable]] in the deriveKey method w3c/webcrypto#384.
-
Allow `length=0` in HKDF and PBKDF2 derive bits operations w3c/webcrypto#380.
-
-
3 pull requests received 7 new comments.
-
set [[usages]] and [[extractable]] in the deriveKey method w3c/webcrypto#384 (5 comments by @panva, @twiss, @w3cbot)
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Add additional security and privacy controls for referrer policies w3c/webappsec-referrer-policy#174, by @rshaner-stripe.
-
-
1 pull request opened.
-
Update a step number referenced in the fetch spec w3c/webappsec-referrer-policy#173, by @shanehandley.
-
-
1 pull request merged.
-
Update a step number referenced in the fetch spec w3c/webappsec-referrer-policy#173.
-
-
1 pull request received 1 new comment.
-
Update a step number referenced in the fetch spec w3c/webappsec-referrer-policy#173 (1 comment by @w3cbot)
-
w3c/webappsec-fetch-metadata
-
1 pull request received 4 new comments.
-
Define `Sec-Fetch-Frame-Ancestors`. w3c/webappsec-fetch-metadata#89 (4 comments by @annevk, @cfredric, @johannhof, @mozfreddyb)
-
w3c/webappsec-standardizing-security-semantics-of-cross-site-cookies
-
1 issue opened.
-
Consider using a shorter shortname w3c/webappsec-standardizing-security-semantics-of-cross-site-cookies#1, by @tidoust.
-
w3c/webappsec
-
2 issues closed.
-
"End-to-End Encryption email" is missing an actual proposal w3c/webappsec#646.
-
Note for Standardizing Security Semantics of Cross-Site Cookies w3c/webappsec#653.
-
-
3 issues received 8 new comments.
-
Note for Standardizing Security Semantics of Cross-Site Cookies w3c/webappsec#653 (5 comments by @DCtheTall, @simoneonofri)
-
-
1 pull request opened.
-
Update 2024-10-16-agenda - Post Quantum Workshop w3c/webappsec#663, by @simoneonofri.
-
-
1 pull request merged.
-
Update 2024-10-16-agenda - Post Quantum Workshop w3c/webappsec#663.
-
w3c/webappsec-clear-site-data
-
1 issue received 1 new comment.
w3c/webappsec-permissions-policy
-
2 issues received 2 new comments.
-
Proposal: allow grouping permissions by year w3c/webappsec-permissions-policy#481 (1 comment by @Seirdy)
TR publications
-
2 documents published.
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
2 participants joined.
-
Yoav Weiss (Shopify) joined.
-
Shaun Warman (PayPal) joined.
-
-
1 participant left.
-
Leonardo Balter (Salesforce) left.
-
-
1 organization joined.
-
PayPal joined.
-
GitHub
w3c/trusted-types
-
5 issues opened.
-
Add tests for getAttributeType()/getPropertyType() for embed@src, object@codebase and object@data w3c/trusted-types#554, by @fred-wang.
-
getPropertyType/getAttributeType when null namespaces are passed. w3c/trusted-types#553, by @fred-wang.
-
Strings from TrustedType columns getPropertyType/getAttributeType tables should be quoted w3c/trusted-types#552, by @fred-wang.
-
Step 8 of getAttributeType() is incorrect w3c/trusted-types#551, by @fred-wang.
-
Dead link to "HTML imports" w3c/trusted-types#550, by @fred-wang.
-
-
10 issues closed.
-
WPTs for pre-navigation check of form-submission should be added w3c/trusted-types#549.
-
Should the default policy be invoked when trusted types are not required? w3c/trusted-types#536.
-
getPropertyType/getAttributeType when null namespaces are passed. w3c/trusted-types#553.
-
There's a lack of test coverage over the namespace aspect of getPropertyType w3c/trusted-types#429.
-
Strings from TrustedType columns getPropertyType/getAttributeType tables should be quoted w3c/trusted-types#552.
-
Export the 'require-trusted-types-for' dfn w3c/trusted-types#538.
-
Step 8 of getAttributeType() is incorrect w3c/trusted-types#551.
-
Dead link to "HTML imports" w3c/trusted-types#550.
-
-
18 issues received 35 new comments.
-
Add tests for getAttributeType()/getPropertyType() for embed@src, object@codebase and object@data w3c/trusted-types#554 (6 comments by @fred-wang, @koto, @lukewarlow)
-
Strings from TrustedType columns getPropertyType/getAttributeType tables should be quoted w3c/trusted-types#552 (4 comments by @fred-wang, @lukewarlow)
-
getPropertyType/getAttributeType when null namespaces are passed. w3c/trusted-types#553 (3 comments by @fred-wang, @koto)
-
There's a lack of test coverage over the namespace aspect of getPropertyType w3c/trusted-types#429 (3 comments by @fred-wang)
-
Creating a policy with policyName="" is possible, but can't be referred to by the "trusted-types" CSP directive w3c/trusted-types#466 (2 comments by @koto)
-
"stringifying" in "Process value with a default policy" needs to be defined w3c/trusted-types#541 (2 comments by @koto)
-
Check variable naming inside of getAttributeType and getPropertyType methods w3c/trusted-types#496 (2 comments by @fred-wang)
-
getAttributeType and getPropertyType should default to HTML namespace, not "" w3c/trusted-types#381 (2 comments by @annevk, @fred-wang)
-
Can lowercasing be removed from getAttributeType()? w3c/trusted-types#424 (2 comments by @annevk, @fred-wang)
-
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names w3c/trusted-types#504 (1 comment by @koto)
-
Add test to <block-string-assignment-to-Element-setAttribute.html> which checks trusted types can be assigned to non-injection sinks w3c/trusted-types#449 (1 comment by @koto)
-
Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`? w3c/trusted-types#534 (1 comment by @koto)
-
WPTs for pre-navigation check of form-submission should be added w3c/trusted-types#549 (1 comment by @koto)
-
getPropertyType and SVGScriptElement href baseVal property w3c/trusted-types#521 (1 comment by @fred-wang)
-
Add WPT that `createPolicy` which violates the `trusted-types` CSP directive fires a violation event for Windows (not Workers) w3c/trusted-types#530 (1 comment by @lukewarlow)
-
-
6 pull requests opened.
-
Disallow empty policy names on creation. w3c/trusted-types#560, by @koto.
-
Replace 'has type' with less confusing 'is an instance of'. w3c/trusted-types#559, by @koto.
-
Fix dead link to "HTML imports" spec w3c/trusted-types#558, by @fred-wang.
-
Treat a null elementNs in getPropertyType/geAtributeType as the HTML … w3c/trusted-types#557, by @fred-wang.
-
Clarify that expectedType is set to the interface's name of TrustedType values w3c/trusted-types#556, by @fred-wang.
-
Fix column indices for callers of "Get Trusted Type data for attribute" w3c/trusted-types#555, by @fred-wang.
-
-
6 pull requests merged.
-
Clarify that expectedType is set to the interface's name of TrustedType values w3c/trusted-types#556.
-
Change Script Enforcement Mechanism to use flags w3c/trusted-types#533.
-
Treat a null elementNs in getPropertyType/geAtributeType as the HTML … w3c/trusted-types#557.
-
Export the two CSP directives w3c/trusted-types#545.
-
Fix column indices for callers of "Get Trusted Type data for attribute" w3c/trusted-types#555.
-
Fix dead link to "HTML imports" spec w3c/trusted-types#558.
-
-
7 pull requests received 9 new comments.
-
Add an |includeReportOnlyPolicies| boolean argument to Does sink type require trusted types? w3c/trusted-types#518 (3 comments by @fred-wang)
-
Treat a null elementNs in getPropertyType/geAtributeType as the HTML … w3c/trusted-types#557 (1 comment by @fred-wang)
-
Clarify that expectedType is set to the interface's name of TrustedType values w3c/trusted-types#556 (1 comment by @fred-wang)
-
Fix column indices for callers of "Get Trusted Type data for attribute" w3c/trusted-types#555 (1 comment by @fred-wang)
-
w3c/webappsec-clear-site-data
-
1 issue received 3 new comments.
w3c/webappsec-csp
-
5 issues opened.
-
How to set CSP without unsafe-inline for site with ads? w3c/webappsec-csp#686, by @SwiftExtender.
-
Parse response’s CSPs parsing header list values type mismatch w3c/webappsec-csp#684, by @ghost.
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683, by @jan-ivar.
-
CSP headers are incorrect with multiple rules w3c/webappsec-csp#682, by @letanloc1998.
-
3 issues closed.
-
How to set CSP without unsafe-inline for site with ads? w3c/webappsec-csp#686.
-
Parse response’s CSPs parsing header list values type mismatch w3c/webappsec-csp#684.
-
Request's initiator can't be "fetch" w3c/webappsec-csp#660.
-
-
8 issues received 23 new comments.
-
Handling of javascript: navigations is not interoperable, spec doesn't match most implementations w3c/webappsec-csp#322 (7 comments by @dinofx, @ghost)
-
How to set CSP without unsafe-inline for site with ads? w3c/webappsec-csp#686 (6 comments by @dveditz, @mikewest, @SwiftExtender)
-
frame-src is not effective in restricting the possible origins of subframes w3c/webappsec-csp#662 (3 comments by @NDevTK, @qabandi)
-
CSP headers are incorrect with multiple rules w3c/webappsec-csp#682 (3 comments by @annevk, @mikewest)
-
Resource hint blocking / "least restrictive" as specified does nothing? w3c/webappsec-csp#633 (1 comment by @jonathanKingston)
-
Introduce new CSP keyword 'unsafe-webtransport-hashes' w3c/webappsec-csp#683 (1 comment by @martinthomson)
-
CSP Report Does Not Reflect Redirected Blocked Domains w3c/webappsec-csp#672 (1 comment by @qabandi)
-
-
1 pull request opened.
-
Fix parsing response's CSP type mismatch w3c/webappsec-csp#685, by @antosart.
-
-
2 pull requests merged.
-
Fix parsing response's CSP type mismatch w3c/webappsec-csp#685.
-
Fix check of request initiator being "fetch" w3c/webappsec-csp#663.
-
-
1 pull request received 2 new comments.
w3c/webcrypto
-
7 issues opened.
-
AES-CBC decrypt: Unspecified error type for ciphertext of odd length w3c/webcrypto#381, by @BenWiederhake.
-
HKDF&PBKDF2: Dead write to "extractable" bit during importKey operation w3c/webcrypto#377, by @BenWiederhake.
-
AES importKey never sets the key's [[type]] internal slot w3c/webcrypto#376, by @BenWiederhake.
-
AES-CBC export operation checks non-existent variable w3c/webcrypto#374, by @BenWiederhake.
-
AES import operations should store key.[[extractable]] w3c/webcrypto#373, by @BenWiederhake.
-
HKDF: Step computes unused variable "extractKey" w3c/webcrypto#371, by @BenWiederhake.
-
Interop issue with HKDF deriveBits operation when length is zero w3c/webcrypto#370, by @javifernandez.
-
-
5 issues closed.
-
HKDF&PBKDF2: Dead write to "extractable" bit during importKey operation w3c/webcrypto#377.
-
AES importKey never sets the key's [[type]] internal slot w3c/webcrypto#376.
-
AES-CBC export operation checks non-existent variable w3c/webcrypto#374.
-
HKDF: Step computes unused variable "extractKey" w3c/webcrypto#371.
-
AES import operations should store key.[[extractable]] w3c/webcrypto#373.
-
-
9 issues received 38 new comments.
-
Interop issue with HKDF deriveBits operation when length is zero w3c/webcrypto#370 (21 comments by @annevk, @davidben, @Frosne, @javifernandez, @nmahendru, @panva, @twiss)
-
AES importKey never sets the key's [[type]] internal slot w3c/webcrypto#376 (4 comments by @BenWiederhake, @twiss)
-
AES import operations should store key.[[extractable]] w3c/webcrypto#373 (4 comments by @BenWiederhake, @panva)
-
Bug 29005 - Add support for secp256k1 curve w3c/webcrypto#82 (3 comments by @coolaj86, @saurik, @twiss)
-
AES-CBC decrypt: Unspecified error type for ciphertext of odd length w3c/webcrypto#381 (1 comment by @twiss)
-
HKDF&PBKDF2: Dead write to "extractable" bit during importKey operation w3c/webcrypto#377 (1 comment by @twiss)
-
-
6 pull requests opened.
-
Throw in AES-CBC decrypt operation for odd ciphertext lengths w3c/webcrypto#382, by @twiss.
-
Allow `length=0` in HKDF and PBKDF2 derive bits operations w3c/webcrypto#380, by @twiss.
-
Remove dead writes to CryptoKey.extractable in HKDF/PBKDF2.importKey w3c/webcrypto#379, by @BenWiederhake.
-
Explicitly set CryptoKey.type to "secret" in AES and HMAC operations w3c/webcrypto#378, by @BenWiederhake.
-
Remove nonsensical test in AES-CBC export key operation w3c/webcrypto#375, by @BenWiederhake.
-
Remove superfluous text in the HKDF derive bits operation w3c/webcrypto#372, by @twiss.
-
-
4 pull requests merged.
-
Remove dead writes to CryptoKey.extractable in HKDF/PBKDF2.importKey w3c/webcrypto#379.
-
Explicitly set CryptoKey.type to "secret" in AES and HMAC operations w3c/webcrypto#378.
-
Remove nonsensical test in AES-CBC export key operation w3c/webcrypto#375.
-
Remove superfluous text in the HKDF derive bits operation w3c/webcrypto#372.
-
-
7 pull requests received 25 new comments.
-
Throw on truncation in the ECDH derive bits operation w3c/webcrypto#351 (7 comments by @javifernandez, @panva, @twiss)
-
Remove nonsensical test in AES-CBC export key operation w3c/webcrypto#375 (4 comments by @BenWiederhake, @twiss, @w3cbot)
-
Explicitly set CryptoKey.type to "secret" in AES and HMAC operations w3c/webcrypto#378 (3 comments by @BenWiederhake, @w3cbot)
-
Allow `length=0` in HKDF and PBKDF2 derive bits operations w3c/webcrypto#380 (1 comment by @javifernandez)
-
Remove dead writes to CryptoKey.extractable in HKDF/PBKDF2.importKey w3c/webcrypto#379 (1 comment by @w3cbot)
w3c/webappsec
-
2 issues opened.
-
Planning 2024-11-20. w3c/webappsec#662, by @mikewest.
-
Planning 2024-10-16. w3c/webappsec#661, by @mikewest.
-
-
1 issue closed.
-
Planning 2024-10-16. w3c/webappsec#661.
-
-
2 issues received 9 new comments.
-
1 pull request merged.
-
Add missing attendee w3c/webappsec#660.
-
w3c/webappsec-referrer-policy
-
1 issue received 1 new comment.
-
Add referrerpolicy to media elements (<audio> and <video>) w3c/webappsec-referrer-policy#160 (1 comment by @khemarato)
-
w3c/webappsec-dbsc
-
2 issues opened.
-
Support for Software Defined Authenticators and Credential Managers w3c/webappsec-dbsc#80, by @nicksteele.
-
Unclear request method for `/securesession/refresh` w3c/webappsec-dbsc#78, by @hagould.
-
-
2 issues received 3 new comments.
-
Unclear request method for `/securesession/refresh` w3c/webappsec-dbsc#78 (2 comments by @chen-chao, @kmonsen)
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56 (1 comment by @chen-chao)
-
-
1 pull request opened.
-
minor edit w3c/webappsec-dbsc#79, by @sbweeden.
-
-
1 pull request merged.
-
minor edit w3c/webappsec-dbsc#79.
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Key active credential types by top-level browsing context w3c/webappsec-credential-management#265, by @npm1.
-
-
1 pull request opened.
-
Make order of checking abort signal in "create algorithm" match "request algorithm" w3c/webappsec-credential-management#264, by @pkotwicz2.
-
-
1 pull request received 1 new comment.
-
Make order of checking abort signal in "create algorithm" match "request algorithm" w3c/webappsec-credential-management#264 (1 comment by @pkotwicz2)
-
w3c/webappsec-permissions-policy
-
8 issues closed.
-
HTTP headers not registered with IANA w3c/webappsec-permissions-policy#331.
-
Disable cross-origin features on sandboxed pages w3c/webappsec-permissions-policy#162.
-
Delineate relationship between Feature Policy and Origin Policy w3c/webappsec-permissions-policy#167.
-
Ensure that 'self' in feature policy syntax is compatible with CSP w3c/webappsec-permissions-policy#124.
-
"allowlist" w3c/webappsec-permissions-policy#103.
-
What's the meaning of the 'Default allowlist' column? w3c/webappsec-permissions-policy#136.
-
How do I disable everything? w3c/webappsec-permissions-policy#208.
-
Deny all like alias for the Permission-Policy: Header w3c/webappsec-permissions-policy#483.
-
-
6 issues received 19 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (14 comments by @annevk, @clelland, @darioseidl, @ewanm89, @Gunni, @jvoisin, @kifd, @marcoscaceres, @PeteX, @vphantom, @weizenspreu)
-
Disable cross-origin features on sandboxed pages w3c/webappsec-permissions-policy#162 (1 comment by @clelland)
-
Delineate relationship between Feature Policy and Origin Policy w3c/webappsec-permissions-policy#167 (1 comment by @clelland)
-
Deny all like alias for the Permission-Policy: Header w3c/webappsec-permissions-policy#483 (1 comment by @clelland)
-
w3c/webappsec-cspee
-
1 pull request received 1 new comment.
-
Add Trusted Types support to CSP Embedded Enforcement w3c/webappsec-cspee#29 (1 comment by @tosmolka)
-
w3c/webappsec-subresource-integrity
-
1 issue closed.
-
Second preimage resistance w3c/webappsec-subresource-integrity#106.
-
-
3 pull requests opened.
-
Update signature-based-restrictions-explainer.markdown w3c/webappsec-subresource-integrity#127, by @mikewest.
-
Specify the supported hashing algorithms. w3c/webappsec-subresource-integrity#126, by @mikewest.
-
Editorial updates w3c/webappsec-subresource-integrity#125, by @mikewest.
-
-
3 pull requests merged.
-
Specify the supported hashing algorithms. w3c/webappsec-subresource-integrity#126.
-
Update signature-based-restrictions-explainer.markdown w3c/webappsec-subresource-integrity#127.
-
Editorial updates w3c/webappsec-subresource-integrity#125.
-
-
2 pull requests received 4 new comments.
-
Specify the supported hashing algorithms. w3c/webappsec-subresource-integrity#126 (2 comments by @annevk, @mikewest)
TR publications
-
6 documents published.
-
Permissions Policy published 3 times as a Working Draft. History of Permissions Policy
-
Trusted Types published twice as a Working Draft. History of Trusted Types
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
Participants
-
12 participants joined.
-
Benjamin VanderSloot (Mozilla Foundation) joined.
-
Ciara McMullin (Google LLC) joined.
-
Ling Zhong (Microsoft Corporation) joined.
-
Simon Wijckmans (Client side development Inc) joined.
-
Limin Zhu (Microsoft Corporation) joined.
-
Andrew Williams (Google LLC) joined.
-
Aaron Shim (Google LLC) joined.
-
Sandor Major (Google LLC) joined.
-
Fabio Rocha (Microsoft Corporation) joined.
-
Siye Liu (Microsoft Corporation) joined.
-
Sanket Joshi (Microsoft Corporation) joined.
-
Cathy Li (Meta) joined.
-
-
2 participants left.
-
Arthur Hemery (Google LLC) left.
-
Andrey Zaytsev (Google LLC) left.
-
-
1 organization joined.
-
Client side development Inc joined.
-
GitHub
w3c/webappsec-permissions-policy
-
15 issues closed.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#537.
-
Make policy scope clear and address tracking risks in the privacy section w3c/webappsec-permissions-policy#406.
-
Remove '*' default allowlist w3c/webappsec-permissions-policy#381.
-
[HEADER-STRUCTURE] reference needs updating w3c/webappsec-permissions-policy#432.
-
incorrect grammar: "and in and HTML attributes" w3c/webappsec-permissions-policy#434.
-
add "otp-credentials" policy-controlled feature token to features.md w3c/webappsec-permissions-policy#443.
-
Mark "ambient-light-sensor" as behind a flag in features.md w3c/webappsec-permissions-policy#478.
-
Clarify "Shipped in Chrome" for picture-in-picture in features.md w3c/webappsec-permissions-policy#502.
-
Add "mediasession" to the list of permission policies w3c/webappsec-permissions-policy#531.
-
Update features.md (e.g., 'storage-access' is missing) w3c/webappsec-permissions-policy#551.
-
Permissions Policy `deferred-fetch` and `deferred-fetch-minimal` w3c/webappsec-permissions-policy#544.
-
[clipboard] document.execCommand('copy') and presumably paste bypass permissions policy w3c/webappsec-permissions-policy#543.
-
Query: Can trusted subframe allocate permission to one of it's cross-domain subframe w3c/webappsec-permissions-policy#542.
-
linkably define term "policy-controlled feature token" w3c/webappsec-permissions-policy#442.
-
Incorret grammar in Container policies green box w3c/webappsec-permissions-policy#439.
-
-
7 issues received 11 new comments.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (3 comments by @clelland, @siliu1)
-
Clarify "Shipped in Chrome" for picture-in-picture in features.md w3c/webappsec-permissions-policy#502 (2 comments by @clelland, @XSpielinbox)
-
linkably define term "policy-controlled feature token" w3c/webappsec-permissions-policy#442 (2 comments by @clelland)
-
[HEADER-STRUCTURE] reference needs updating w3c/webappsec-permissions-policy#432 (1 comment by @clelland)
-
[clipboard] document.execCommand('copy') and presumably paste bypass permissions policy w3c/webappsec-permissions-policy#543 (1 comment by @clelland)
-
Incorret grammar in Container policies green box w3c/webappsec-permissions-policy#439 (1 comment by @clelland)
-
-
1 pull request merged.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#546.
-
-
1 pull request received 6 new comments.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#546 (6 comments by @clelland, @shhnjk)
-
w3c/webcrypto
-
2 issues opened.
-
Throw for all truncation in ECDH? w3c/webcrypto#369, by @twiss.
-
Missing tasks in parallel steps in Web Cryptography API w3c/webcrypto#368, by @dontcallmedom-bot.
-
-
3 issues received 12 new comments.
-
Throw for all truncation in ECDH? w3c/webcrypto#369 (10 comments by @annevk, @davidben, @javifernandez, @panva, @twiss)
-
-
1 pull request merged.
-
Fix the definition of SHA-512 w3c/webcrypto#360.
-
-
1 pull request received 6 new comments.
-
Throw on truncation in the ECDH derive bits operation w3c/webcrypto#351 (6 comments by @annevk, @davidben, @javifernandez, @panva, @twiss)
-
w3c/webappsec-csp
-
3 issues opened.
-
port-part being null is not handled w3c/webappsec-csp#680, by @evilpie.
-
Feedback request on not capturing the caller in `new Function` and indirect `eval` w3c/webappsec-csp#679, by @nicolo-ribaudo.
-
"pre-navigation-check" w3c/webappsec-csp#678, by @ghost.
-
-
1 issue closed.
-
"pre-navigation-check" w3c/webappsec-csp#678.
-
-
3 issues received 3 new comments.
-
Add new CSP sandbox directive to allow SameSite=None cookies on top-level frames w3c/webappsec-csp#664 (1 comment by @DCtheTall)
-
1 pull request merged.
-
Upstream Trusted Types enforcement in EnsureCSPDoesNotBlockStringCompilation w3c/webappsec-csp#659.
-
-
2 pull requests received 18 new comments.
-
Upstream Trusted Types enforcement in EnsureCSPDoesNotBlockStringCompilation w3c/webappsec-csp#659 (17 comments by @lukewarlow, @mikewest)
-
Add `trusted-types-eval` source expression for `script-src` w3c/webappsec-csp#665 (1 comment by @lukewarlow)
-
w3c/webappsec-dbsc
-
2 issues opened.
-
Use DBSC without Browser support? w3c/webappsec-dbsc#72, by @longzhou.
-
البلاغ عن موقع احتيال مالي w3c/webappsec-dbsc#70, by @Norah0-0.
-
-
7 issues closed.
-
Check/inform status of DBSC per session/site in Chrome UI w3c/webappsec-dbsc#37.
-
Should this approach extend to native applications? w3c/webappsec-dbsc#38.
-
Why send JWTs two different ways? w3c/webappsec-dbsc#53.
-
البلاغ عن موقع احتيال مالي w3c/webappsec-dbsc#70.
-
Public key in JWT w3c/webappsec-dbsc#44.
-
Use DBSC without Browser support? w3c/webappsec-dbsc#72.
-
Response headers should use consistent separators w3c/webappsec-dbsc#54.
-
-
6 issues received 19 new comments.
-
HTTP 401 MUST return a WWW-Authenticate header w3c/webappsec-dbsc#65 (7 comments by @aaronpk, @danmarg, @kmonsen, @MattMenke2)
-
Response headers should use consistent separators w3c/webappsec-dbsc#54 (6 comments by @chen-chao, @kmonsen, @sbweeden)
-
Should this approach extend to native applications? w3c/webappsec-dbsc#38 (3 comments by @arianvp, @kmonsen, @NickBorgers)
-
Check/inform status of DBSC per session/site in Chrome UI w3c/webappsec-dbsc#37 (1 comment by @kmonsen)
-
-
6 pull requests opened.
-
Fix typo in README w3c/webappsec-dbsc#77, by @fmarier.
-
Update TOC in the main README w3c/webappsec-dbsc#76, by @sameerag.
-
Update DBSC(E) links in the main repo w3c/webappsec-dbsc#75, by @sameerag.
-
Fix links to DBSCE folder in main README w3c/webappsec-dbsc#74, by @halflumi.
-
Dbsc(e) explainer w3c/webappsec-dbsc#73, by @sameerag.
-
Update Sec-Session-Challenge header w3c/webappsec-dbsc#71, by @chen-chao.
-
-
6 pull requests merged.
-
Update TOC in the main README w3c/webappsec-dbsc#76.
-
Update DBSC(E) links in the main repo w3c/webappsec-dbsc#75.
-
Dbsc(e) explainer w3c/webappsec-dbsc#73.
-
Dbsc(e) w3c/webappsec-dbsc#67.
-
Update Sec-Session-Challenge header w3c/webappsec-dbsc#71.
-
Use jsonc for JSON blocks that have comments w3c/webappsec-dbsc#69.
-
-
1 pull request closed.
-
Fix links to DBSCE folder in main README w3c/webappsec-dbsc#74.
-
-
4 pull requests received 86 new comments.
w3c/webappsec
-
3 issues opened.
-
Surfacing capability URLs w3c/webappsec#657, by @yoavweiss.
-
CSP and data exfiltration w3c/webappsec#656, by @yoavweiss.
-
Revive `require-sri-for`? w3c/webappsec#655, by @yoavweiss.
-
-
1 issue closed.
-
Planning TPAC. w3c/webappsec#654.
-
-
3 issues received 26 new comments.
-
CSP and data exfiltration w3c/webappsec#656 (18 comments by @ArcEglos, @arturjanc, @dveditz, @estark37, @lknik, @mozfreddyb, @shhnjk, @weizman, @yoavweiss)
-
Planning TPAC. w3c/webappsec#654 (7 comments by @DCtheTall, @ddworken, @mikewest, @sanketj, @weizman, @yoavweiss)
-
-
3 pull requests opened.
-
Add missing attendee w3c/webappsec#660, by @weizman.
-
Update link for cross-site cookie semantics w3c/webappsec#659, by @arturjanc.
-
Add WK RP Passkey Endpoints w3c/webappsec#658, by @timcappalli.
-
-
1 pull request merged.
-
Update link for cross-site cookie semantics w3c/webappsec#659.
-
w3c/permissions
-
1 issue opened.
-
Clearly require use of 'permission state' to be 'in parallel' w3c/permissions#453, by @jyasskin.
-
-
2 issues received 3 new comments.
-
Interaction between browser and system permissions w3c/permissions#332 (2 comments by @npdoty, @reillyeon)
-
Clearly require use of 'permission state' to be 'in parallel' w3c/permissions#453 (1 comment by @tidoust)
-
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Industry Resource Prelude w3c/webappsec-fetch-metadata#91, by @sadduccees-jrowling392.
-
-
1 issue closed.
-
Industry Resource Prelude w3c/webappsec-fetch-metadata#91.
-
w3c/trusted-types
-
4 issues opened.
-
WPTs for pre-navigation check of form-submission should be added w3c/trusted-types#549, by @ghost.
-
"pre-navigation check" uses "request’s clients's global object" which is null w3c/trusted-types#548, by @ghost.
-
Add WPT for "create navigation params by fetching" step 19.3 w3c/trusted-types#547, by @ghost.
-
https://html.spec.whatwg.org/#dom-range-createcontextualfragment should pass "'script'" w3c/trusted-types#543, by @ghost.
-
-
2 issues closed.
-
Add WPT for "create navigation params by fetching" step 19.3 w3c/trusted-types#547.
-
CSP sample for eval and Function w3c/trusted-types#491.
-
-
4 issues received 7 new comments.
-
Add WPT for "create navigation params by fetching" step 19.3 w3c/trusted-types#547 (4 comments by @ghost, @otherdaniel)
-
WPTs for pre-navigation check of form-submission should be added w3c/trusted-types#549 (1 comment by @ghost)
-
"pre-navigation check" uses "request’s clients's global object" which is null w3c/trusted-types#548 (1 comment by @koto)
-
Should the default policy be invoked when trusted types are not required? w3c/trusted-types#536 (1 comment by @mozfreddyb)
-
-
2 pull requests opened.
-
Export the two CSP directives w3c/trusted-types#545, by @lukewarlow.
-
Remove CSP dynamic code compilation block w3c/trusted-types#544, by @lukewarlow.
-
-
2 pull requests merged.
-
Strip "function anonymous" prefixes from Function samples w3c/trusted-types#539.
-
Remove CSP dynamic code compilation block w3c/trusted-types#544.
-
-
1 pull request received 1 new comment.
w3c/webappsec-credential-management
-
3 issues opened.
-
Allow credential types to specify user activation requirements w3c/webappsec-credential-management#263, by @bvandersloot-mozilla.
-
Add feature detection for credential type mixing w3c/webappsec-credential-management#262, by @bvandersloot-mozilla.
-
Missing tasks in parallel steps in Credential Management Level 1 w3c/webappsec-credential-management#260, by @dontcallmedom-bot.
-
-
2 issues received 2 new comments.
-
Should mediation be defaulted at all? w3c/webappsec-credential-management#256 (1 comment by @nsatragno)
-
Disallow multiple types via navigator.credentials's methods w3c/webappsec-credential-management#244 (1 comment by @marcoscaceres)
-
-
1 pull request opened.
-
Define with types are allowed in the same get() request w3c/webappsec-credential-management#261, by @mohamedamir.
-
-
2 pull requests received 13 new comments.
-
Define with types are allowed in the same get() request w3c/webappsec-credential-management#261 (10 comments by @mohamedamir, @nsatragno)
-
Let specs define their own default mediation requirement w3c/webappsec-credential-management#258 (3 comments by @nsatragno)
-
TR publications
-
1 document published.
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Past meetings
-
1 meeting.
Participants
-
2 participants joined.
-
Anusha Muley (Google LLC) joined.
-
Shouqun Liu (ByteDance) joined.
-
GitHub
w3c/webappsec-csp
-
2 issues opened.
-
Should font-src reporting kick in on font-face reference or font request? w3c/webappsec-csp#677, by @robinwhittleton.
-
loading local stylesheets without self source w3c/webappsec-csp#676, by @nizos.
-
-
4 issues received 10 new comments.
-
Should font-src reporting kick in on font-face reference or font request? w3c/webappsec-csp#677 (6 comments by @annevk, @emilio, @robinwhittleton)
-
w3c/webappsec-dbsc
-
1 issue reopened.
-
Public key in JWT w3c/webappsec-dbsc#44, by @kmonsen.
-
-
2 issues received 5 new comments.
-
3 pull requests opened.
-
Use jsonc for JSON blocks that have comments w3c/webappsec-dbsc#69, by @halflumi.
-
Change public key in JWT payload to use the JWK format w3c/webappsec-dbsc#68, by @halflumi.
-
-
1 pull request merged.
-
Change public key in JWT payload to use the JWK format w3c/webappsec-dbsc#68.
-
-
1 pull request received 222 new comments.
-
Dbsc(e) w3c/webappsec-dbsc#67 (222 comments by @alextok, @halflumi, @oldalton, @peterzenz, @sameerag, @timcappalli)
-
w3c/webappsec-upgrade-insecure-requests
-
1 issue opened.
-
Normative references to discontinued specs in Upgrade Insecure Requests w3c/webappsec-upgrade-insecure-requests#34, by @dontcallmedom-bot.
-
w3c/webappsec-referrer-policy
-
1 issue opened.
-
Normative references to discontinued specs in Referrer Policy w3c/webappsec-referrer-policy#172, by @dontcallmedom-bot.
-
-
2 issues closed.
-
Normative references to discontinued specs in Referrer Policy w3c/webappsec-referrer-policy#172.
-
Add Referrer-Policy to HTTP Field Name Registry w3c/webappsec-referrer-policy#168.
-
-
1 issue received 1 new comment.
-
Add Referrer-Policy to HTTP Field Name Registry w3c/webappsec-referrer-policy#168 (1 comment by @stiiin)
-
-
1 pull request opened.
-
Added IANA considerations section for HTTP header w3c/webappsec-referrer-policy#171, by @stiiin.
-
-
1 pull request closed.
-
Added IANA considerations section for HTTP header w3c/webappsec-referrer-policy#171.
-
-
1 pull request received 11 new comments.
-
Added IANA considerations section for HTTP header w3c/webappsec-referrer-policy#171 (11 comments by @annevk, @domfarolino, @mikewest, @mnot, @simoneonofri, @stiiin)
-
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Normative references to discontinued specs in Subresource Integrity w3c/webappsec-subresource-integrity#124, by @dontcallmedom-bot.
-
w3c/trusted-types
-
3 issues opened.
-
"Get Trusted Type compliant string" is called with "script" instead of "'script'" w3c/trusted-types#542, by @ghost.
-
"stringifying" in "Process value with a default policy" needs to be defined w3c/trusted-types#541, by @ghost.
-
How can policyValue be 'undefined'? w3c/trusted-types#540, by @smaug----.
-
-
4 issues received 7 new comments.
-
How can policyValue be 'undefined'? w3c/trusted-types#540 (2 comments by @lukewarlow, @petervanderbeken)
-
"Get Trusted Type compliant string" is called with "script" instead of "'script'" w3c/trusted-types#542 (1 comment by @petervanderbeken)
-
"stringifying" in "Process value with a default policy" needs to be defined w3c/trusted-types#541 (1 comment by @ghost)
w3c/webappsec-credential-management
-
5 issues opened.
-
Unclear `relevant credential interface objects` in section 2.3.1 w3c/webappsec-credential-management#259, by @tete17.
-
Throw a InvalidStateError when hitting multiple in-progress credential requests? w3c/webappsec-credential-management#257, by @marcoscaceres.
-
Should mediation be defaulted at all? w3c/webappsec-credential-management#256, by @marcoscaceres.
-
Consider extracting PasswordCredential and FederatedCredential to separate specs? w3c/webappsec-credential-management#255, by @lukewarlow.
-
The "ask the user to choose a Credential" should talk about top origin w3c/webappsec-credential-management#254, by @marcoscaceres.
-
-
3 issues received 21 new comments.
-
Disallow multiple types via navigator.credentials's methods w3c/webappsec-credential-management#244 (14 comments by @bvandersloot-mozilla, @marcoscaceres, @nsatragno, @samuelgoto)
-
Should mediation be defaulted at all? w3c/webappsec-credential-management#256 (5 comments by @marcoscaceres, @samuelgoto)
-
Consider extracting PasswordCredential and FederatedCredential to separate specs? w3c/webappsec-credential-management#255 (2 comments by @lukewarlow, @marcoscaceres)
-
-
2 pull requests opened.
-
Let specs define their own default mediation requirement w3c/webappsec-credential-management#258, by @marcoscaceres.
-
remove noexport for same-origin with ancestors w3c/webappsec-credential-management#253, by @timcappalli.
-
-
1 pull request merged.
-
Editorial: clean up some promise jargon w3c/webappsec-credential-management#252.
-
-
3 pull requests received 11 new comments.
-
remove noexport for same-origin with ancestors w3c/webappsec-credential-management#253 (5 comments by @domenic, @marcoscaceres, @nsatragno)
-
Let specs define their own default mediation requirement w3c/webappsec-credential-management#258 (4 comments by @marcoscaceres)
-
Editorial: clean up some promise jargon w3c/webappsec-credential-management#252 (2 comments by @marcoscaceres, @nsatragno)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
Default Powerful Feature Permission w3c/webappsec-permissions-policy#555, by @ecki.
-
-
1 issue closed.
-
2 issues received 3 new comments.
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (2 comments by @josephrocca)
-
Deny all like alias for the Permission-Policy: Header w3c/webappsec-permissions-policy#483 (1 comment by @mobeigi)
-
-
2 pull requests received 15 new comments.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#546 (14 comments by @clelland, @shhnjk)
-
Update section on 'Other and related mechanisms' w3c/webappsec-permissions-policy#82 (1 comment by @ecki)
-
w3c/webcrypto
-
2 issues opened.
-
Support for PQC algorithms: ML-KEM, ML-DSA and SLH-DSA ? w3c/webcrypto#367, by @seriousme.
-
Name disambiguation w3c/webcrypto#366, by @autonome.
-
-
1 issue closed.
-
Name disambiguation w3c/webcrypto#366.
-
-
6 issues received 13 new comments.
-
Support for PQC algorithms: ML-KEM, ML-DSA and SLH-DSA ? w3c/webcrypto#367 (2 comments by @Neustradamus, @seriousme)
-
1 pull request received 1 new comment.
w3c/permissions
-
1 pull request received 1 new comment.
w3c/webappsec-secure-contexts
-
1 issue opened.
-
****URGENT**** malicious deployment with the integration of your software needs to be noted. w3c/webappsec-secure-contexts#106, by @QuantumFandT.
-
-
1 issue closed.
-
****URGENT**** malicious deployment with the integration of your software needs to be noted. w3c/webappsec-secure-contexts#106.
-
w3c/webappsec
-
1 issue opened.
-
Planning TPAC. w3c/webappsec#654, by @mikewest.
-
-
2 issues received 6 new comments.
-
Clarify CSP header recommendations for non-HTML pages w3c/webappsec#520 (2 comments by @amalkrishnan43216, @SmashManiac)
TR publications
-
6 documents published.
-
Credential Management Level 1 published 3 times as a Working Draft. History of Credential Management Level 1
-
Permissions Policy published twice as a Working Draft. History of Permissions Policy
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Past meetings
-
1 meeting.
Participants
-
1 participant left.
-
Samuel Weinig (Apple Inc.) left.
-
GitHub
w3c/webappsec-dbsc
-
3 issues opened.
-
HTTP 401 MUST return a WWW-Authenticate header w3c/webappsec-dbsc#65, by @danmarg.
-
Is there a timeline for when DBSC will be available on OSX and other OSs? w3c/webappsec-dbsc#64, by @ahallsc.
-
PoC using swtpm w3c/webappsec-dbsc#63, by @theMiddleBlue.
-
-
5 issues received 14 new comments.
-
HTTP 401 MUST return a WWW-Authenticate header w3c/webappsec-dbsc#65 (8 comments by @danmarg, @kmonsen, @mattjm, @MattMenke2)
-
`Sec-` prefix for a server header w3c/webappsec-dbsc#59 (3 comments by @arnar, @theMiddleBlue, @yoavweiss)
-
Refresh session performance 2: Fresh nonce prefetching. w3c/webappsec-dbsc#61 (1 comment by @danmarg)
-
Refresh session performance 1: Waiting for response from the server. w3c/webappsec-dbsc#60 (1 comment by @danmarg)
-
w3c/webappsec-csp
-
5 issues opened.
-
Consider using SecurityPolicyViolationEvent.sourceFile a USVString w3c/webappsec-csp#674, by @emilio.
-
CSP spec not user-friendly w3c/webappsec-csp#673, by @galund.
-
CSP Report Does Not Reflect Redirected Blocked Domains w3c/webappsec-csp#672, by @ConardLi.
-
Queries about exfiltration? w3c/webappsec-csp#671, by @Blason.
-
Even though I have domains specified in the CSP policy violations still appear w3c/webappsec-csp#670, by @Blason.
-
-
2 issues closed.
-
Queries about exfiltration? w3c/webappsec-csp#671.
-
Even though I have domains specified in the CSP policy violations still appear w3c/webappsec-csp#670.
-
-
7 issues received 15 new comments.
-
CSP Report Does Not Reflect Redirected Blocked Domains w3c/webappsec-csp#672 (7 comments by @annevk, @clelland, @ConardLi, @mikewest)
-
Possibility to block all javascript: URLs w3c/webappsec-csp#658 (2 comments by @awwright, @norman-cmt)
-
Even though I have domains specified in the CSP policy violations still appear w3c/webappsec-csp#670 (2 comments by @Blason, @mikewest)
-
Consider using SecurityPolicyViolationEvent.sourceFile a USVString w3c/webappsec-csp#674 (1 comment by @emilio)
-
-
1 pull request closed.
-
Add `[SecureContext]` tag to the interfaces w3c/webappsec-csp#642.
-
-
2 pull requests received 4 new comments.
-
Upstream Trusted Types enforcement in EnsureCSPDoesNotBlockStringCompilation w3c/webappsec-csp#659 (1 comment by @lukewarlow)
w3c/webappsec-credential-management
-
6 issues opened.
-
Add test for calling non-fully-active .store() / add automation? w3c/webappsec-credential-management#251, by @marcoscaceres.
-
Request a credential behavior when no interface is matched w3c/webappsec-credential-management#249, by @marcoscaceres.
-
User mediation is *credential type* based w3c/webappsec-credential-management#248, by @marcoscaceres.
-
Aborting and the AbortSignal does seem to be fully handled w3c/webappsec-credential-management#247, by @marcoscaceres.
-
Disallow multiple types via navigator.credentials's methods w3c/webappsec-credential-management#244, by @marcoscaceres.
-
Consider not running internal methods in parallel or add "consumes user activation" to registry? w3c/webappsec-credential-management#243, by @marcoscaceres.
-
-
1 issue closed.
-
Request a credential behavior when no interface is matched w3c/webappsec-credential-management#249.
-
-
4 issues received 15 new comments.
-
Consider not running internal methods in parallel or add "consumes user activation" to registry? w3c/webappsec-credential-management#243 (8 comments by @bvandersloot-mozilla, @marcoscaceres, @nsatragno, @stephenmcgruer)
-
Disallow multiple types via navigator.credentials's methods w3c/webappsec-credential-management#244 (4 comments by @marcoscaceres, @nsatragno)
-
User mediation is *credential type* based w3c/webappsec-credential-management#248 (2 comments by @marcoscaceres)
-
Request a credential behavior when no interface is matched w3c/webappsec-credential-management#249 (1 comment by @marcoscaceres)
-
-
5 pull requests opened.
-
Editorial: clean up some promise jargon w3c/webappsec-credential-management#252, by @marcoscaceres.
-
Disallow empty credential selection w3c/webappsec-credential-management#250, by @marcoscaceres.
-
Editorial: fix small bs syntax mistakes w3c/webappsec-credential-management#246, by @marcoscaceres.
-
Use 'InvalidStateError' for fully active check w3c/webappsec-credential-management#245, by @marcoscaceres.
-
Use credential type registry for permissions + digital credentials w3c/webappsec-credential-management#242, by @marcoscaceres.
-
-
4 pull requests merged.
-
Disallow empty credential selection w3c/webappsec-credential-management#250.
-
Use 'InvalidStateError' for fully active check w3c/webappsec-credential-management#245.
-
Editorial: fix small bs syntax mistakes w3c/webappsec-credential-management#246.
-
Use credential type registry for permissions + digital credentials w3c/webappsec-credential-management#242.
-
-
1 pull request closed.
-
Introduce bad() to deal with expired credentials w3c/webappsec-credential-management#60.
-
-
5 pull requests received 38 new comments.
-
Use credential type registry for permissions + digital credentials w3c/webappsec-credential-management#242 (24 comments by @marcoscaceres, @nsatragno, @tidoust)
-
Use 'InvalidStateError' for fully active check w3c/webappsec-credential-management#245 (9 comments by @marcoscaceres, @nsatragno)
-
Disallow empty credential selection w3c/webappsec-credential-management#250 (3 comments by @marcoscaceres)
-
Editorial: fix small bs syntax mistakes w3c/webappsec-credential-management#246 (1 comment by @nsatragno)
-
Introduce bad() to deal with expired credentials w3c/webappsec-credential-management#60 (1 comment by @marcoscaceres)
-
w3c/trusted-types
-
6 issues opened.
-
Export the 'require-trusted-types-for' dfn w3c/trusted-types#538, by @robbiemc.
-
Does the DOM spec really need to special case script elements for replaceChildren etc. w3c/trusted-types#537, by @lukewarlow.
-
Should the default policy be invoked when trusted types are not required? w3c/trusted-types#536, by @ghost.
-
Should the APIs for creating a TrustedScript etc return a frozen object? w3c/trusted-types#535, by @lukewarlow.
-
Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`? w3c/trusted-types#534, by @ghost.
-
Is "code updating a script before it finishes parsing" within the threat model of Trusted Types? w3c/trusted-types#532, by @lukewarlow.
-
-
7 issues closed.
-
"Create a Trusted Type Policy" should specify the TypeError messages w3c/trusted-types#511.
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221.
-
Clarify interaction between unsafe-eval and TrustedScript. w3c/trusted-types#143.
-
Callback IDL types w3c/trusted-types#482.
-
Integration with WebIDL w3c/trusted-types#400.
-
TrustedTypePolicyFactory getTypeMapping() missing from spec. w3c/trusted-types#432.
-
-
1 issue reopened.
-
Stringification of TrustedHTML with `null`-data needs to be specified w3c/trusted-types#469, by @lukewarlow.
-
-
14 issues received 33 new comments.
-
Script element mid-parse protection mechanism w3c/trusted-types#525 (9 comments by @domfarolino, @ghost, @lukewarlow, @smaug----)
-
CSP sample for eval and Function w3c/trusted-types#491 (4 comments by @ghost, @lukewarlow, @otherdaniel)
-
Is "code updating a script before it finishes parsing" within the threat model of Trusted Types? w3c/trusted-types#532 (4 comments by @lukewarlow, @otherdaniel)
-
Does the DOM spec really need to special case script elements for replaceChildren etc. w3c/trusted-types#537 (3 comments by @ghost, @lukewarlow)
-
Should the default policy be invoked when trusted types are not required? w3c/trusted-types#536 (3 comments by @ghost, @koto)
-
Stringification of TrustedHTML with `null`-data needs to be specified w3c/trusted-types#469 (2 comments by @annevk, @lukewarlow)
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221 (1 comment by @lukewarlow)
-
Should the APIs for creating a TrustedScript etc return a frozen object? w3c/trusted-types#535 (1 comment by @lukewarlow)
-
TrustedTypePolicyFactory getTypeMapping() missing from spec. w3c/trusted-types#432 (1 comment by @lukewarlow)
-
Should all 3 script IDL setters change the associated script text value identically w3c/trusted-types#517 (1 comment by @lukewarlow)
-
getPropertyType and SVGScriptElement href baseVal property w3c/trusted-types#521 (1 comment by @lukewarlow)
-
-
2 pull requests opened.
-
Strip "function anonymous" prefixes from Function samples w3c/trusted-types#539, by @lukewarlow.
-
Change Script Enforcement Mechanism to use flags w3c/trusted-types#533, by @lukewarlow.
-
-
1 pull request merged.
-
Update TrustedTypePolicyOptions usages to use map syntax. w3c/trusted-types#528.
-
-
1 pull request closed.
-
Add script protection mechanisms to SVGScriptElement w3c/trusted-types#524.
-
-
2 pull requests received 27 new comments.
-
Change Script Enforcement Mechanism to use flags w3c/trusted-types#533 (18 comments by @annevk, @lukewarlow)
-
Add script protection mechanisms to SVGScriptElement w3c/trusted-types#524 (9 comments by @annevk, @lukewarlow)
-
w3c/webappsec-clear-site-data
-
1 issue opened.
-
web preferences api w3c/webappsec-clear-site-data#83, by @bkardell.
-
-
3 issues received 9 new comments.
-
Clear a specific cookie w3c/webappsec-clear-site-data#82 (3 comments by @annevk, @arturjanc, @johannhof)
w3c/webappsec-permissions-policy
-
2 issues received 2 new comments.
-
> 07881334 2 002065 031525 054161 F-3525824 PANYA YAOWALA ( AIA ) 0107537002761 0872220535 3410200102061 *01401125350 341020009143 3410200102096 41001470 165467 T-078813339 T078813342 w3c/webappsec-permissions-policy#538 (1 comment by @Usermsn)
-
-
1 pull request opened.
-
Add all-screens-capture permissions policy w3c/webappsec-permissions-policy#553, by @shangl.
-
-
2 pull requests merged.
-
Add all-screens-capture permissions policy w3c/webappsec-permissions-policy#553.
-
Add digital-credential-get experimental permission to features.md w3c/webappsec-permissions-policy#549.
-
-
1 pull request received 2 new comments.
-
Add digital-credential-get experimental permission to features.md w3c/webappsec-permissions-policy#549 (2 comments by @clelland, @pkotwicz2)
-
w3c/permissions
-
1 pull request opened.
-
Editorial: Fix sentences around permission states w3c/permissions#452, by @saschanaz.
-
-
1 pull request received 1 new comment.
w3c/webcrypto
-
1 issue opened.
-
2 issues received 13 new comments.
-
Bug 29005 - Add support for secp256k1 curve w3c/webcrypto#82 (10 comments by @cf, @coldstar1993, @hazae41, @paulmillr, @pkieltyka, @twiss)
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (3 comments by @kdenhartog, @matthiasgeihs)
-
w3c/webappsec
-
1 issue opened.
-
Note for Standardizing Security Semantics of Cross-Site Cookies w3c/webappsec#653, by @DCtheTall.
-
-
1 issue received 4 new comments.
-
Note for Standardizing Security Semantics of Cross-Site Cookies w3c/webappsec#653 (4 comments by @arturjanc, @mikewest, @simoneonofri)
-
w3c/webappsec-secure-contexts
-
1 issue received 1 new comment.
w3c/webappsec-mixed-content
-
1 issue opened.
-
References to "Does Not (Prohibit|Restrict) Mixed Security Contexts" are inconsistent w3c/webappsec-mixed-content#72, by @shanehandley.
-
w3c/webappsec-subresource-integrity
-
1 issue received 1 new comment.
-
Idea: Add Integrity Request Header w3c/webappsec-subresource-integrity#123 (1 comment by @mozfreddyb)
-
TR publications
-
12 documents published.
-
Permissions Policy published 4 times as a Working Draft. History of Permissions Policy
-
Trusted Types published 3 times as a Working Draft. History of Trusted Types
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Credential Management Level 1 published twice as a Working Draft. History of Credential Management Level 1
-
A Well-Known URL for Changing Passwords published as a Working Draft. History of A Well-Known URL for Changing Passwords
-
Past meetings
-
1 meeting.
GitHub
w3c/webappsec-dbsc
-
4 issues opened.
-
Use Outside of Google w3c/webappsec-dbsc#62, by @amitassaraf.
-
Refresh session performance 2: Fresh nonce prefetching. w3c/webappsec-dbsc#61, by @alextok.
-
Refresh session performance 1: Waiting for response from the server. w3c/webappsec-dbsc#60, by @alextok.
-
`Sec-` prefix for a server header w3c/webappsec-dbsc#59, by @yoavweiss.
-
-
2 issues closed.
-
JWS algorithms are case-sensitive w3c/webappsec-dbsc#41.
-
How can we tell when there is running code available in Chrome Canary w3c/webappsec-dbsc#50.
-
-
6 issues received 8 new comments.
-
How can we tell when there is running code available in Chrome Canary w3c/webappsec-dbsc#50 (1 comment by @kmonsen)
w3c/webappsec-subresource-integrity
-
1 issue opened.
-
Idea: Add Integrity Request Header w3c/webappsec-subresource-integrity#123, by @tetsuyainfra.
-
w3c/webappsec-permissions-policy
-
3 issues opened.
-
PP header inheritance for local schemes w3c/webappsec-permissions-policy#552, by @AlbertoFDR.
-
Update features.md (e.g., 'storage-access' is missing) w3c/webappsec-permissions-policy#551, by @JannisBush.
-
Example 3 is misleading/Delegating Trust to Nested Contexts w3c/webappsec-permissions-policy#550, by @JannisBush.
-
-
2 issues closed.
-
JS playgrounds leak permissions. Guidelines and examples needed w3c/webappsec-permissions-policy#547.
-
PermissionsPolicyViolationReportBody is missing a toJSON operation w3c/webappsec-permissions-policy#469.
-
-
5 issues received 6 new comments.
-
Feature policy for not messing with scrolling? w3c/webappsec-permissions-policy#171 (2 comments by @clelland, @Desentso)
-
Update features.md (e.g., 'storage-access' is missing) w3c/webappsec-permissions-policy#551 (1 comment by @clelland)
-
PP header inheritance for local schemes w3c/webappsec-permissions-policy#552 (1 comment by @clelland)
-
Feature Policy: downloads-without-user-activation w3c/webappsec-permissions-policy#289 (1 comment by @MarcWadai)
-
-
1 pull request opened.
-
Add digital-credential-get experimental permission to features.md w3c/webappsec-permissions-policy#549, by @pkotwicz2.
-
-
5 pull requests merged.
-
Add two "JS playground" examples. w3c/webappsec-permissions-policy#548.
-
Add PermissionsPolicyViolationReportBody toJSON operation w3c/webappsec-permissions-policy#472.
-
Include feature status of some directives w3c/webappsec-permissions-policy#545.
-
Add smart-card w3c/webappsec-permissions-policy#496.
-
Propose identity-credential-get permission policy w3c/webappsec-permissions-policy#488.
-
-
1 pull request closed.
-
Default allowlists only effect child browsing contexts w3c/webappsec-permissions-policy#431.
-
-
5 pull requests received 12 new comments.
-
Add two "JS playground" examples. w3c/webappsec-permissions-policy#548 (5 comments by @Brunojoes69, @clelland)
-
Add digital-credential-get experimental permission to features.md w3c/webappsec-permissions-policy#549 (2 comments by @clelland, @samuelgoto)
-
Include feature status of some directives w3c/webappsec-permissions-policy#545 (2 comments by @clelland, @w3cbot)
-
Default allowlists only effect child browsing contexts w3c/webappsec-permissions-policy#431 (1 comment by @clelland)
-
w3c/webappsec-csp
-
3 issues opened.
-
`report-sample` is not checked when firing "securitypolicyviolation" events w3c/webappsec-csp#669, by @ghost.
-
[Meta] PR Previews not working w3c/webappsec-csp#667, by @lukewarlow.
-
"trusted-types-policy" missing from a violation's resource w3c/webappsec-csp#666, by @ghost.
-
-
3 issues closed.
-
`report-sample` is not checked when firing "securitypolicyviolation" events w3c/webappsec-csp#669.
-
[Meta] PR Previews not working w3c/webappsec-csp#667.
-
"trusted-types-policy" missing from a violation's resource w3c/webappsec-csp#666.
-
-
7 issues received 7 new comments.
-
`'report-hash'`: Adding hashes of blocked content to violation reports w3c/webappsec-csp#575 (1 comment by @bmeck)
-
`report-sample` is not checked when firing "securitypolicyviolation" events w3c/webappsec-csp#669 (1 comment by @lukewarlow)
-
"trusted-types-policy" missing from a violation's resource w3c/webappsec-csp#666 (1 comment by @lukewarlow)
-
-
1 pull request opened.
-
Fix .pr-preview.json w3c/webappsec-csp#668, by @lukewarlow.
-
-
2 pull requests merged.
-
Fix .pr-preview.json w3c/webappsec-csp#668.
-
-
5 pull requests received 10 new comments.
-
Specify behavior in case of malformed policies w3c/webappsec-csp#363 (3 comments by @ghost, @lukewarlow, @mozfreddyb)
-
Update EnsureCSPDoesNotBlockStringCompilation to match updated HostEnsureCanCompileStrings definition w3c/webappsec-csp#650 (2 comments by @annevk, @lukewarlow)
-
Add `trusted-types-eval` source expression for `script-src` w3c/webappsec-csp#665 (2 comments by @annevk, @lukewarlow)
-
w3c/trusted-types
-
6 issues opened.
-
Should the `trusted-types` CSP directive support the `report-sample` keyword? w3c/trusted-types#531, by @ghost.
-
Add WPTs for `report-uri` with Workers w3c/trusted-types#526, by @ghost.
-
Script element mid-parse protection mechanism w3c/trusted-types#525, by @lukewarlow.
-
getPropertyType and SVGScriptElement href baseVal property w3c/trusted-types#521, by @lukewarlow.
-
Finalise spec mechanism for event handlers w3c/trusted-types#520, by @lukewarlow.
-
-
9 issues closed.
-
Should the `trusted-types` CSP directive support the `report-sample` keyword? w3c/trusted-types#531.
-
Issue with script enforcement w3c/trusted-types#437.
-
Set slot values when called directly by the parser w3c/trusted-types#252.
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207.
-
getAttributeType() needs a rewrite w3c/trusted-types#423.
-
Event handler enforcement section wrong w3c/trusted-types#474.
-
`getPropertyType()` needs a rewrite? w3c/trusted-types#456.
-
WPT for CSP header `trusted-types 'none' 'none'` missing w3c/trusted-types#508.
-
-
9 issues received 33 new comments.
-
Stringification of TrustedHTML with `null`-data needs to be specified w3c/trusted-types#469 (10 comments by @ghost, @lukewarlow, @petervanderbeken)
-
Finalise spec mechanism for event handlers w3c/trusted-types#520 (7 comments by @koto, @lukewarlow, @otherdaniel)
-
Should the `trusted-types` CSP directive support the `report-sample` keyword? w3c/trusted-types#531 (7 comments by @ghost, @lukewarlow)
-
WPT for CSP header `trusted-types 'none' 'none'` missing w3c/trusted-types#508 (3 comments by @ghost, @lukewarlow, @ziransun)
-
Can we drop the default policy value changing from Eval, new Function() (and other usages of the dynamic code brand checks proposal)? w3c/trusted-types#461 (2 comments by @lukewarlow)
-
getPropertyType and SVGScriptElement href baseVal property w3c/trusted-types#521 (1 comment by @koto)
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (1 comment by @lukewarlow)
-
-
6 pull requests opened.
-
Update `<wpt>` block w3c/trusted-types#529, by @lukewarlow.
-
Update TrustedTypePolicyOptions usages to use map syntax. w3c/trusted-types#528, by @lukewarlow.
-
Handle null policyValue in Create a Trusted Type w3c/trusted-types#527, by @lukewarlow.
-
Add script protection mechanisms to SVGScriptElement w3c/trusted-types#524, by @lukewarlow.
-
Remove HostEnsureCanCompileStrings and HostGetCodeForEval w3c/trusted-types#523, by @lukewarlow.
-
Remove timer integration block w3c/trusted-types#522, by @lukewarlow.
-
-
7 pull requests merged.
-
Handle null policyValue in Create a Trusted Type w3c/trusted-types#527.
-
Update `<wpt>` block w3c/trusted-types#529.
-
Remove HostEnsureCanCompileStrings and HostGetCodeForEval w3c/trusted-types#523.
-
Update HTML Parser steps for script element to set "script text" w3c/trusted-types#499.
-
Remove timer integration block w3c/trusted-types#522.
-
Remove StringContext attribute w3c/trusted-types#498.
-
Rewrite metadata functions w3c/trusted-types#457.
-
-
4 pull requests received 24 new comments.
-
Add script protection mechanisms to SVGScriptElement w3c/trusted-types#524 (12 comments by @annevk, @lukewarlow)
-
Handle null policyValue in Create a Trusted Type w3c/trusted-types#527 (6 comments by @koto, @lukewarlow, @petervanderbeken)
-
Update HTML Parser steps for script element to set "script text" w3c/trusted-types#499 (3 comments by @lukewarlow)
-
w3c/webcrypto
-
2 issues closed.
-
Consider making the deriveBits length argument optional w3c/webcrypto#329.
-
deriveBits length idl does not allow null w3c/webcrypto#322.
-
-
1 issue received 5 new comments.
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (5 comments by @kdenhartog, @matthiasgeihs, @thegodfatherbeeearth, @yawn)
-
-
1 pull request merged.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345.
-
-
1 pull request received 7 new comments.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345 (7 comments by @javifernandez, @twiss)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
User activation w3c/webappsec-credential-management#241, by @marcoscaceres.
-
-
1 issue closed.
-
User activation w3c/webappsec-credential-management#241.
-
-
1 issue received 2 new comments.
-
2 pull requests opened.
-
Chore: export "origin-bound" definition w3c/webappsec-credential-management#240, by @marcoscaceres.
-
Chore: add Marcos to the editor's list w3c/webappsec-credential-management#239, by @marcoscaceres.
-
-
2 pull requests merged.
-
Chore: add Marcos to the editor's list w3c/webappsec-credential-management#239.
-
Chore: export "origin-bound" definition w3c/webappsec-credential-management#240.
-
-
2 pull requests received 2 new comments.
-
Chore: add Marcos to the editor's list w3c/webappsec-credential-management#239 (1 comment by @marcoscaceres)
-
Drop 'origin' from public interfaces after #100. w3c/webappsec-credential-management#131 (1 comment by @marcoscaceres)
-
w3c/webappsec-clear-site-data
-
2 issues opened.
-
Clear a specific cookie w3c/webappsec-clear-site-data#82, by @yoavweiss.
-
Clear a specific URL from cache w3c/webappsec-clear-site-data#81, by @yoavweiss.
-
w3c/webappsec
-
1 issue received 1 new comment.
w3c/webappsec-secure-contexts
-
1 issue opened.
-
Rescind this specification w3c/webappsec-secure-contexts#104, by @drzraf.
-
-
1 issue received 1 new comment.
w3c/webappsec-fetch-metadata
-
1 issue opened.
-
Opener information w3c/webappsec-fetch-metadata#90, by @yoavweiss.
-
-
2 issues received 4 new comments.
-
Metadata to indicate if fetch was instigated as a result of 103 early hints w3c/webappsec-fetch-metadata#86 (1 comment by @yoavweiss)
w3c/permissions
-
1 issue opened.
-
Definition of Powerful Features w3c/permissions#451, by @torgo.
-
-
1 issue received 2 new comments.
w3c/webappsec-mixed-content
-
1 issue opened.
-
Are there any compliant mixed download implementations? w3c/webappsec-mixed-content#71, by @hamishwillee.
-
-
1 issue closed.
-
Are there any compliant mixed download implementations? w3c/webappsec-mixed-content#71.
-
-
1 issue received 4 new comments.
-
Are there any compliant mixed download implementations? w3c/webappsec-mixed-content#71 (4 comments by @annevk, @hamishwillee)
-
w3c/webappsec-change-password-url
-
1 pull request merged.
-
Drop a reference to Request's synchronous flag, which was removed from the Fetch spec. w3c/webappsec-change-password-url#47.
-
TR publications
-
5 documents published.
-
Trusted Types published as a Working Draft. History of Trusted Types
-
Credential Management Level 1 published 4 times as a Working Draft. History of Credential Management Level 1
-
Past meetings
-
1 meeting.
GitHub
w3c/webappsec-change-password-url
-
1 pull request opened.
-
Drop a reference to Request's synchronous flag, which was removed from the Fetch spec. w3c/webappsec-change-password-url#47, by @hober.
-
w3c/webappsec-csp
-
3 issues opened.
-
Add new CSP sandbox directive to allow SameSite=None cookies on top-level frames w3c/webappsec-csp#664, by @DCtheTall.
-
frame-src is not effective in restricting the possible origins of subframes w3c/webappsec-csp#662, by @antosart.
-
Request's initiator can't be "fetch" w3c/webappsec-csp#660, by @zcorpan.
-
-
3 issues received 8 new comments.
-
Add new CSP sandbox directive to allow SameSite=None cookies on top-level frames w3c/webappsec-csp#664 (6 comments by @annevk, @DCtheTall, @johannhof, @mikewest)
-
-
3 pull requests opened.
-
Add `trusted-types-eval` source expression for `script-src` w3c/webappsec-csp#665, by @lukewarlow.
-
Fix check of request initiator being "fetch" w3c/webappsec-csp#663, by @antosart.
-
Upstream Trusted Types enforcement in EnsureCSPDoesNotBlockStringCompilation w3c/webappsec-csp#659, by @lukewarlow.
-
-
3 pull requests received 4 new comments.
-
Add `trusted-types-eval` source expression for `script-src` w3c/webappsec-csp#665 (2 comments by @annevk, @lukewarlow)
-
[editorial] Make algorithm headers clickable w3c/webappsec-csp#621 (1 comment by @oasissbasinessltd)
-
w3c/webappsec-credential-management
-
1 issue opened.
-
Can we drop the "webappsec-" from the rep name w3c/webappsec-credential-management#229, by @marcoscaceres.
-
-
4 issues closed.
-
Mediation parameter for credential creation w3c/webappsec-credential-management#225.
-
Replace "a priori authenticated URL" with "potentially trustworthy URL" w3c/webappsec-credential-management#166.
-
update all <a ...> anchors to use bikeshed shortcuts like [= w3c/webappsec-credential-management#180.
-
Replace iff w3c/webappsec-credential-management#222.
-
-
1 issue reopened.
-
Reaction/recheck to non-fully active documents w3c/webappsec-credential-management#227, by @marcoscaceres.
-
-
2 issues received 4 new comments.
-
Can we drop the "webappsec-" from the rep name w3c/webappsec-credential-management#229 (3 comments by @clelland, @marcoscaceres)
-
Reaction/recheck to non-fully active documents w3c/webappsec-credential-management#227 (1 comment by @marcoscaceres)
-
-
9 pull requests opened.
-
Chore: Update Ubuntu version w3c/webappsec-credential-management#238, by @marcoscaceres.
-
Do fully active check on Prevent Silent Access w3c/webappsec-credential-management#237, by @marcoscaceres.
-
Full active check should happen before AbortSignal check w3c/webappsec-credential-management#236, by @marcoscaceres.
-
Editorial: fixup prevent silent access xrefs w3c/webappsec-credential-management#235, by @marcoscaceres.
-
Editorial: Replace "a priori authenticated URL" with "potentially trustworthy URL w3c/webappsec-credential-management#234, by @marcoscaceres.
-
Editorial: use bikeshed shorthands w3c/webappsec-credential-management#233, by @marcoscaceres.
-
Editorial: expand iff to if and only if w3c/webappsec-credential-management#232, by @marcoscaceres.
-
chore: add PULL_REQUEST_TEMPLATE w3c/webappsec-credential-management#231, by @marcoscaceres.
-
Add fully active checks w3c/webappsec-credential-management#230, by @marcoscaceres.
-
-
10 pull requests merged.
-
Add mediation to credential creation options w3c/webappsec-credential-management#224.
-
Do fully active check on Prevent Silent Access w3c/webappsec-credential-management#237.
-
Chore: Update Ubuntu version w3c/webappsec-credential-management#238.
-
Full active check should happen before AbortSignal check w3c/webappsec-credential-management#236.
-
Add fully active checks w3c/webappsec-credential-management#230.
-
Editorial: fixup prevent silent access xrefs w3c/webappsec-credential-management#235.
-
Editorial: Replace "a priori authenticated URL" with "potentially trustworthy URL w3c/webappsec-credential-management#234.
-
Editorial: use bikeshed shorthands w3c/webappsec-credential-management#233.
-
Editorial: expand iff to if and only if w3c/webappsec-credential-management#232.
-
chore: add PULL_REQUEST_TEMPLATE w3c/webappsec-credential-management#231.
-
-
5 pull requests received 20 new comments.
-
Add fully active checks w3c/webappsec-credential-management#230 (14 comments by @marcoscaceres, @nsatragno)
-
Add mediation to credential creation options w3c/webappsec-credential-management#224 (3 comments by @marcoscaceres)
-
Do fully active check on Prevent Silent Access w3c/webappsec-credential-management#237 (1 comment by @nsatragno)
-
Full active check should happen before AbortSignal check w3c/webappsec-credential-management#236 (1 comment by @marcoscaceres)
-
Editorial: fixup prevent silent access xrefs w3c/webappsec-credential-management#235 (1 comment by @nsatragno)
-
w3c/trusted-types
-
4 issues opened.
-
Seeking Trusted Types feedback on Array.isTemplateObject w3c/trusted-types#519, by @littledan.
-
Should all 3 script IDL setters change the associated script text value identically w3c/trusted-types#517, by @lukewarlow.
-
Add WPTs for CSP `sandbox allow-scripts` combined with Trusted Types w3c/trusted-types#513, by @ghost.
-
Should SVGScriptElement have an IDL way to set a trusted script value? w3c/trusted-types#512, by @lukewarlow.
-
-
2 issues closed.
-
Spec / implementation mismatch with document.write/writeln w3c/trusted-types#510.
-
`execCommand` spec won't work w3c/trusted-types#500.
-
-
7 issues received 28 new comments.
-
Should all 3 script IDL setters change the associated script text value identically w3c/trusted-types#517 (10 comments by @annevk, @koto, @lukewarlow)
-
WPT for CSP header `trusted-types 'none' 'none'` missing w3c/trusted-types#508 (6 comments by @ghost, @lukewarlow, @ziransun)
-
Seeking Trusted Types feedback on Array.isTemplateObject w3c/trusted-types#519 (5 comments by @annevk, @koto, @littledan, @lukewarlow)
-
Add WPTs for CSP `sandbox allow-scripts` combined with Trusted Types w3c/trusted-types#513 (2 comments by @annevk, @ghost)
-
Spec / implementation mismatch with document.write/writeln w3c/trusted-types#510 (2 comments by @lukewarlow)
-
Should SVGScriptElement have an IDL way to set a trusted script value? w3c/trusted-types#512 (2 comments by @annevk, @lukewarlow)
-
"Create a Trusted Type Policy" should specify the TypeError messages w3c/trusted-types#511 (1 comment by @lukewarlow)
-
-
4 pull requests opened.
-
Add an |includeReportOnlyPolicies| boolean argument to Does sink type require trusted types? w3c/trusted-types#518, by @lukewarlow.
-
Replace timer functions section with upstream PR link w3c/trusted-types#516, by @lukewarlow.
-
Remove links to merged upstream PRs w3c/trusted-types#515, by @lukewarlow.
-
Replace EnsureCSPDoesNotBlockStringCompilation section with link to upstream PR w3c/trusted-types#514, by @lukewarlow.
-
-
3 pull requests merged.
-
Replace timer functions section with upstream PR link w3c/trusted-types#516.
-
Replace EnsureCSPDoesNotBlockStringCompilation section with link to upstream PR w3c/trusted-types#514.
-
Remove links to merged upstream PRs w3c/trusted-types#515.
-
-
1 pull request closed.
-
Add new `trusted-eval` source expression to 'script-src' directive. w3c/trusted-types#473.
-
-
4 pull requests received 15 new comments.
-
Update HTML Parser steps for script element to set "script text" w3c/trusted-types#499 (8 comments by @annevk, @lukewarlow)
-
Add new `trusted-eval` source expression to 'script-src' directive. w3c/trusted-types#473 (2 comments by @lukewarlow)
-
Replace EnsureCSPDoesNotBlockStringCompilation section with link to upstream PR w3c/trusted-types#514 (2 comments by @koto, @lukewarlow)
-
w3c/webappsec-permissions-policy
-
1 issue opened.
-
JS playgrounds leak permissions. Guidelines and examples needed w3c/webappsec-permissions-policy#547, by @jan-ivar.
-
-
2 issues received 12 new comments.
-
JS playgrounds leak permissions. Guidelines and examples needed w3c/webappsec-permissions-policy#547 (10 comments by @annevk, @jan-ivar, @rockinghelvetica)
-
-
1 pull request opened.
-
Add two "JS playground" examples. w3c/webappsec-permissions-policy#548, by @jan-ivar.
-
-
2 pull requests received 7 new comments.
-
Add two "JS playground" examples. w3c/webappsec-permissions-policy#548 (6 comments by @marcoscaceres)
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#546 (1 comment by @shhnjk)
-
w3c/webappsec-dbsc
-
1 issue opened.
-
Can DBSC stop common adversary in the middle attacks? w3c/webappsec-dbsc#57, by @RogerAGrimes.
-
-
1 issue closed.
-
Can DBSC stop common adversary in the middle attacks? w3c/webappsec-dbsc#57.
-
-
4 issues received 6 new comments.
-
Can DBSC stop common adversary in the middle attacks? w3c/webappsec-dbsc#57 (2 comments by @RogerAGrimes, @wparad)
-
alignment with OAuth 2 flows for 1P authorization servers w3c/webappsec-dbsc#31 (2 comments by @dickhardt, @mattjm)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Mixed content terms - confusing English w3c/webappsec-mixed-content#70, by @hamishwillee.
-
-
1 issue received 1 new comment.
w3c/webappsec
-
1 issue opened.
-
Planning 2024-06-19 w3c/webappsec#652, by @dveditz.
-
-
1 issue closed.
-
Planning 2024-05-15. w3c/webappsec#651.
-
-
2 issues received 2 new comments.
w3c/webappsec-fetch-metadata
-
1 pull request received 14 new comments.
-
Define `Sec-Fetch-Frame-Ancestors`. w3c/webappsec-fetch-metadata#89 (14 comments by @annevk, @arichiv, @arturjanc, @johannhof, @mikewest)
-
w3c/permissions
-
1 issue opened.
-
Add an optional `topLevelOrigin` argument to `permissions.setPermission` WebDriver BiDi command w3c/permissions#450, by @lutien.
-
w3c/webcrypto
-
1 issue received 1 new comment.
Lifecycle
TR publications
-
2 documents published.
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Past meetings
-
1 meeting.
Participants
-
7 participants joined.
-
Ibrahima NGOM (Ecole Superieure Polytechnique de Dakar) joined.
-
Ahmath Bamba MBACKE (Ecole Superieure Polytechnique de Dakar) joined.
-
Anna Weine (Mozilla Foundation) joined.
-
David Adrian (Google LLC) joined.
-
Joe DeBlasio (Google LLC) joined.
-
chuanlei ma (Ant Group Co., Ltd.) joined.
-
Jim Peng (Ant Group Co., Ltd.) joined.
-
-
2 organizations joined.
-
Ecole Superieure Polytechnique de Dakar joined.
-
Ant Group Co., Ltd. joined.
-
GitHub
w3c/webappsec-permissions-policy
-
2 issues received 2 new comments.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#537 (1 comment by @shhnjk)
-
-
2 pull requests opened.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#546, by @shhnjk.
-
Include feature status of some directives w3c/webappsec-permissions-policy#545, by @0xedward.
-
w3c/webappsec-fetch-metadata
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Define `Sec-Fetch-Frame-Ancestors`. w3c/webappsec-fetch-metadata#89, by @mikewest.
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
8 issues opened.
-
"Create a Trusted Type Policy" should specify the TypeError messages w3c/trusted-types#511, by @ghost.
-
Spec / implementation mismatch with document.write/writeln w3c/trusted-types#510, by @lukewarlow.
-
WPT for CSP header `trusted-types 'none' 'none'` missing w3c/trusted-types#508, by @ghost.
-
Script element protection model w3c/trusted-types#507, by @lukewarlow.
-
faq.md outdated w3c/trusted-types#505, by @lukewarlow.
-
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names w3c/trusted-types#504, by @ghost.
-
`execCommand` spec won't work w3c/trusted-types#500, by @lukewarlow.
-
-
8 issues closed.
-
Get trusted type compliant attribute value sink w3c/trusted-types#492.
-
Integration with DOM APIs w3c/trusted-types#438.
-
faq.md outdated w3c/trusted-types#505.
-
Ensure at least one representative of all classes of injection sinks is guarded with TT w3c/trusted-types#419.
-
Compare polyfill versions and the native implementation in the documentation w3c/trusted-types#301.
-
insertAdjacentText in polyfill w3c/trusted-types#300.
-
Maybe remove plugin enforcement from Trusted Types? w3c/trusted-types#305.
-
2 issues reopened.
-
Improve test coverage for DOM integration in WPT w3c/trusted-types#425.
-
insertAdjacentText in polyfill w3c/trusted-types#300, by @lukewarlow.
-
-
13 issues received 38 new comments.
-
Spec / implementation mismatch with document.write/writeln w3c/trusted-types#510 (6 comments by @annevk, @lukewarlow, @otherdaniel)
-
`createPolicy`'s permitted policy names are inconsistent with CSP's permitted policy names w3c/trusted-types#504 (5 comments by @annevk, @ghost, @lukewarlow, @mikewest)
-
"Validate the string in context" takes any value and calls "Get Trusted Type compliant string" which requires a TrustedType or a string w3c/trusted-types#488 (3 comments by @lukewarlow, @petervanderbeken)
-
"Create a Trusted Type Policy" should specify the TypeError messages w3c/trusted-types#511 (2 comments by @annevk, @ghost)
-
Ensure at least one representative of all classes of injection sinks is guarded with TT w3c/trusted-types#419 (2 comments by @ghost, @lukewarlow)
-
Compare polyfill versions and the native implementation in the documentation w3c/trusted-types#301 (1 comment by @lukewarlow)
-
7 pull requests opened.
-
Link to spec PRs for in-progress upstreams w3c/trusted-types#506, by @lukewarlow.
-
Fix links to innerHTML property. w3c/trusted-types#503, by @lukewarlow.
-
Update slots w3c/trusted-types#502, by @lukewarlow.
-
Update spec to match latest ECMA262 proposal shape. w3c/trusted-types#501, by @lukewarlow.
-
Update HTML Parser steps for script element to set "script text" w3c/trusted-types#499, by @lukewarlow.
-
Remove StringContext attribute w3c/trusted-types#498, by @lukewarlow.
-
Fix type issue between get tt compliant string and validate string in context w3c/trusted-types#497, by @lukewarlow.
-
-
8 pull requests merged.
-
Link to spec PRs for in-progress upstreams w3c/trusted-types#506.
-
Update IDL for script enforcement w3c/trusted-types#484.
-
Update spec to match latest ECMA262 proposal shape. w3c/trusted-types#501.
-
Update slots w3c/trusted-types#502.
-
Fix links to innerHTML property. w3c/trusted-types#503.
-
Fix IDL of getAttributeType and getPropertyType w3c/trusted-types#460.
-
Remove outdated event handler section w3c/trusted-types#495.
-
Remove enforcement from embed and object elements w3c/trusted-types#486.
-
-
2 pull requests closed.
-
Fix type issue between get tt compliant string and validate string in context w3c/trusted-types#497.
-
Make sink an argument to get tt compliant attribute value w3c/trusted-types#493.
-
-
1 pull request reopened.
-
Update IDL for script enforcement w3c/trusted-types#484, by @lukewarlow.
-
-
9 pull requests received 59 new comments.
-
Update HTML Parser steps for script element to set "script text" w3c/trusted-types#499 (11 comments by @annevk, @lukewarlow, @otherdaniel)
-
Update spec to match latest ECMA262 proposal shape. w3c/trusted-types#501 (2 comments by @lukewarlow)
-
Fix type issue between get tt compliant string and validate string in context w3c/trusted-types#497 (2 comments by @lukewarlow)
w3c/permissions
-
1 issue opened.
-
Add a validation step for origin argument for WebDriver BiDi setPermission command w3c/permissions#449, by @lutien.
-
w3c/webappsec-csp
-
3 issues opened.
-
Possibility to block all javascript: URLs w3c/webappsec-csp#658, by @Sjord.
-
host-part match doesn't handle * w3c/webappsec-csp#656, by @evilpie.
-
strict-dynamic and SRI w3c/webappsec-csp#653, by @annevk.
-
-
2 issues closed.
-
host-part match doesn't handle * w3c/webappsec-csp#656.
-
strict-dynamic and SRI w3c/webappsec-csp#653.
-
-
4 issues received 7 new comments.
-
3 pull requests opened.
-
Correctly match `*` as a `host-part`. w3c/webappsec-csp#657, by @mikewest.
-
Add notes about non-normativity. w3c/webappsec-csp#655, by @mikewest.
-
Fix script post-request check for scripts allowed by hashes w3c/webappsec-csp#654, by @antosart.
-
-
3 pull requests merged.
-
Correctly match `*` as a `host-part`. w3c/webappsec-csp#657.
-
Add notes about non-normativity. w3c/webappsec-csp#655.
-
Fix script post-request check for scripts allowed by hashes w3c/webappsec-csp#654.
-
-
3 pull requests received 8 new comments.
-
Update EnsureCSPDoesNotBlockStringCompilation to match updated HostEnsureCanCompileStrings definition w3c/webappsec-csp#650 (4 comments by @annevk, @lukewarlow)
-
w3c/webappsec-dbsc
-
33 issues opened.
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56, by @tblachowicz.
-
Details on Session Identifier are not clear in the Explainer w3c/webappsec-dbsc#55, by @tblachowicz.
-
Response headers should use consistent separators w3c/webappsec-dbsc#54, by @sbweeden.
-
Why send JWTs two different ways? w3c/webappsec-dbsc#53, by @sbweeden.
-
How can we tell when there is running code available in Chrome Canary w3c/webappsec-dbsc#50, by @sbweeden.
-
JWTs are not themselves base64url encoded w3c/webappsec-dbsc#47, by @bc-pi.
-
A simpler flow proposal w3c/webappsec-dbsc#46, by @el1s7.
-
how are endpoints conveyed from server to browser? w3c/webappsec-dbsc#45, by @bc-pi.
-
Public key in JWT w3c/webappsec-dbsc#44, by @bc-pi.
-
jti/nonce/challenge value? w3c/webappsec-dbsc#43, by @bc-pi.
-
iat is a number w3c/webappsec-dbsc#42, by @bc-pi.
-
JWS algorithms are case-sensitive w3c/webappsec-dbsc#41, by @bc-pi.
-
What is the expectation of multi-site cross-site signatures? w3c/webappsec-dbsc#40, by @wparad.
-
[Fetch] What's stopping us from using the Fetch API configuration to support this? w3c/webappsec-dbsc#39, by @wparad.
-
Should this approach extend to native applications? w3c/webappsec-dbsc#38, by @NickBorgersOnLowSecurityNode.
-
Check/inform status of DBSC per session/site in Chrome UI w3c/webappsec-dbsc#37, by @GuiPoM.
-
MVP Recommendation: TOTP w3c/webappsec-dbsc#36, by @wparad.
-
An attack vector for DBSC: w3c/webappsec-dbsc#35, by @maxhata.
-
Need for attestation? w3c/webappsec-dbsc#34, by @jackevans43.
-
timed refresh mechanism w3c/webappsec-dbsc#33, by @dickhardt.
-
Login Status API? w3c/webappsec-dbsc#32, by @dickhardt.
-
alignment with OAuth 2 flows for 1P authorization servers w3c/webappsec-dbsc#31, by @dickhardt.
-
explain `excluded scope` w3c/webappsec-dbsc#30, by @dickhardt.
-
Reduce latency by including refresh challenge w3c/webappsec-dbsc#29, by @dickhardt.
-
JWT clarifications needed w3c/webappsec-dbsc#28, by @dickhardt.
-
Explicitly type the JWT w3c/webappsec-dbsc#27, by @dickhardt.
-
How do servers manage the public keys and the sessions? w3c/webappsec-dbsc#26, by @hdfrk.
-
IP binding with Cookies cant be enough ? w3c/webappsec-dbsc#25, by @threatdecoder.
-
Question RE: Tracking and Identity Providers w3c/webappsec-dbsc#24, by @whitehatguy.
-
Require request signing for proof-of-possession w3c/webappsec-dbsc#23, by @joaopenteado.
-
Really supportive of this effort! w3c/webappsec-dbsc#22, by @miketheitguy.
-
non-TPM devices? Android and iPhone / iOS | iPadOS TPM equivalents? w3c/webappsec-dbsc#21, by @anwarmahmood1.
-
Cluttering the TPM and potential denial of service ? w3c/webappsec-dbsc#20, by @HoLyVieR.
-
-
27 issues received 190 new comments.
-
A simpler flow proposal w3c/webappsec-dbsc#46 (56 comments by @arnar, @danmarg, @el1s7, @jackevans43, @kmonsen, @Sora2455, @tbroyer, @wparad, @zainazeem)
-
Require request signing for proof-of-possession w3c/webappsec-dbsc#23 (18 comments by @arnar, @jackevans43, @joaopenteado, @Sora2455, @wparad)
-
how are endpoints conveyed from server to browser? w3c/webappsec-dbsc#45 (13 comments by @arnar, @bc-pi, @kmonsen)
-
Cluttering the TPM and potential denial of service ? w3c/webappsec-dbsc#20 (13 comments by @arnar, @Avamander, @HoLyVieR, @kmonsen, @mattjm, @TaaviE)
-
JWS algorithms are case-sensitive w3c/webappsec-dbsc#41 (12 comments by @arnar, @bc-pi, @kmonsen, @wparad)
-
How can we tell when there is running code available in Chrome Canary w3c/webappsec-dbsc#50 (8 comments by @kmonsen, @LanderDK, @MasterKale, @sbweeden)
-
Insufficient rationale w3c/webappsec-dbsc#13 (8 comments by @arnar, @danmarg, @NickBorgersOnLowSecurityNode, @simon-friedberger)
-
non-TPM devices? Android and iPhone / iOS | iPadOS TPM equivalents? w3c/webappsec-dbsc#21 (7 comments by @anwarmahmood1, @arianvp, @kmonsen, @Sora2455)
-
JWTs are not themselves base64url encoded w3c/webappsec-dbsc#47 (5 comments by @arnar, @dickhardt, @kmonsen, @wparad)
-
Need for attestation? w3c/webappsec-dbsc#34 (5 comments by @arnar, @danmarg, @jackevans43, @venkyg-sec)
-
Check/inform status of DBSC per session/site in Chrome UI w3c/webappsec-dbsc#37 (4 comments by @arnar, @GuiPoM, @Sora2455)
-
How do servers manage the public keys and the sessions? w3c/webappsec-dbsc#26 (4 comments by @arnar, @dickhardt, @hdfrk)
-
Should this approach extend to native applications? w3c/webappsec-dbsc#38 (2 comments by @arnar, @NickBorgersOnLowSecurityNode)
-
Where does the challenge value go in the Registration JWT? w3c/webappsec-dbsc#56 (1 comment by @bc-pi)
-
alignment with OAuth 2 flows for 1P authorization servers w3c/webappsec-dbsc#31 (1 comment by @wparad)
-
The scheme is a little bit redundant for a redirect-based auth w3c/webappsec-dbsc#12 (1 comment by @mattjm)
-
-
2 pull requests opened.
-
Add linked description for a use case w3c/webappsec-dbsc#48, by @wparad.
-
1 pull request merged.
-
typos w3c/webappsec-dbsc#51.
-
-
2 pull requests received 2 new comments.
w3c/webappsec-passkey-endpoints
-
2 pull requests opened.
-
chore: additional setup w3c/webappsec-passkey-endpoints#6, by @plehegar.
-
chore: Moved to index.bs. Tim's affiliation w3c/webappsec-passkey-endpoints#5, by @plehegar.
-
-
3 pull requests merged.
-
chore: additional setup w3c/webappsec-passkey-endpoints#6.
-
chore: Moved to index.bs. Tim's affiliation w3c/webappsec-passkey-endpoints#5.
-
Fix some of the doc metadata w3c/webappsec-passkey-endpoints#4.
-
w3c/webappsec
-
1 issue opened.
-
Planning 2024-05-15. w3c/webappsec#651, by @mikewest.
-
-
1 issue closed.
-
Planning the 2024-04-17. w3c/webappsec#648.
-
-
1 issue reopened.
-
"End-to-End Encryption email" is missing an actual proposal w3c/webappsec#646, by @marcoscaceres.
-
-
3 issues received 13 new comments.
-
Planning the 2024-04-17. w3c/webappsec#648 (9 comments by @Frosne, @javifernandez, @marcoscaceres, @mikewest, @plehegar, @twiss)
-
"End-to-End Encryption email" is missing an actual proposal w3c/webappsec#646 (3 comments by @marcoscaceres, @plehegar)
-
-
2 pull requests opened.
-
Revert "Drop e2e (#649)" w3c/webappsec#650, by @marcoscaceres.
-
-
1 pull request merged.
-
Drop e2e w3c/webappsec#649.
-
-
1 pull request closed.
-
Revert "Drop e2e (#649)" w3c/webappsec#650.
-
-
1 pull request received 2 new comments.
w3c/webcrypto
-
1 issue received 2 new comments.
-
PROPOSAL: Add support for general (hardware backed) cryptographic signatures and key exchange w3c/webcrypto#263 (2 comments by @cybercent, @ptdecker)
-
-
1 pull request received 6 new comments.
w3c/webappsec-subresource-integrity
-
1 issue received 5 new comments.
-
Explicitly encourage user agents to validate cache content via integrity attributes w3c/webappsec-subresource-integrity#101 (5 comments by @jayaddison)
-
TR publications
-
2 documents published.
-
Permissions published twice as a Working Draft. History of Permissions
-
Past meetings
-
1 meeting.
Participants
-
1 Team contact appointed.
-
Simone Onofri became a Team contact.
-
-
3 participants joined.
-
Simone Onofri (W3C) joined.
-
Zbigniew Tenerowicz (Consensys) joined.
-
Javier Fernandez (Igalia) joined.
-
-
2 participants left.
-
Sergey Kataev (Google LLC) left.
-
Chaals Nevile (Consensys) left.
-
GitHub
w3c/webappsec-permissions-policy
-
1 issue opened.
-
Permissions Policy `deferred-fetch` and `deferred-fetch-minimal` w3c/webappsec-permissions-policy#544, by @mingyc.
-
-
5 issues received 23 new comments.
-
Proposal: define default for all w3c/webappsec-permissions-policy#189 (9 comments by @dimaqq, @Gunni, @Seirdy, @theherk, @vphantom, @yannikbloscheck)
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#537 (7 comments by @annevk, @arturjanc, @clelland, @shhnjk, @thngkaiyuan)
-
How do I disable everything? w3c/webappsec-permissions-policy#208 (4 comments by @anarcat, @Dreamsorcerer, @nextgenthemes)
-
Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273 (2 comments by @josephrocca, @SHISME)
-
Proposal: Transition 'sync-xhr' feature to Document Policy w3c/webappsec-permissions-policy#410 (1 comment by @annevk)
-
w3c/webappsec-csp
-
3 issues opened.
-
Content Security Policy (CSP) Bypass via Same-Origin iFrames w3c/webappsec-csp#652, by @avivkeller.
-
Upstream trusted type changes w3c/webappsec-csp#651, by @lukewarlow.
-
Document columnNumber format w3c/webappsec-csp#649, by @stefnotch.
-
-
3 issues closed.
-
Content Security Policy (CSP) Bypass via Same-Origin iFrames w3c/webappsec-csp#652.
-
WebRTC can be used for exfiltration w3c/webappsec-csp#92.
-
Confusion revolving around sandbox 'allow-top-navigation' directive w3c/webappsec-csp#647.
-
-
7 issues received 11 new comments.
-
Confusion revolving around sandbox 'allow-top-navigation' directive w3c/webappsec-csp#647 (2 comments by @antosart, @franklyn07)
-
CSP:EE does not support Trusted Types CSP directives w3c/webappsec-csp#628 (2 comments by @shhnjk, @tosmolka)
-
Content Security Policy (CSP) Bypass via Same-Origin iFrames w3c/webappsec-csp#652 (1 comment by @avivkeller)
-
1 pull request opened.
-
Update EnsureCSPDoesNotBlockStringCompilation to match updated HostEnsureCanCompileStrings definition w3c/webappsec-csp#650, by @lukewarlow.
-
-
1 pull request received 4 new comments.
-
Update EnsureCSPDoesNotBlockStringCompilation to match updated HostEnsureCanCompileStrings definition w3c/webappsec-csp#650 (4 comments by @annevk, @lukewarlow)
-
w3c/trusted-types
-
17 issues opened.
-
Check variable naming inside of getAttributeType and getPropertyType methods w3c/trusted-types#496, by @lukewarlow.
-
Improve test coverage of sink values w3c/trusted-types#494, by @lukewarlow.
-
Get trusted type compliant attribute value sink w3c/trusted-types#492, by @lukewarlow.
-
CSP sample for eval and Function w3c/trusted-types#491, by @lukewarlow.
-
SVGScriptElement needs TT protection too w3c/trusted-types#483, by @lukewarlow.
-
Callback IDL types w3c/trusted-types#482, by @lukewarlow.
-
HTML timers as specced won't work w3c/trusted-types#480, by @lukewarlow.
-
[Meta] Upstream changes w3c/trusted-types#476, by @lukewarlow.
-
Event handler enforcement section wrong w3c/trusted-types#474, by @lukewarlow.
-
Adopt Infra syntax throughout w3c/trusted-types#472, by @annevk.
-
Developer-centric research results about Trusted Types w3c/trusted-types#471, by @rothsn.
-
Create a Trusted Type Policy seems to directly set properties to callbacks w3c/trusted-types#470, by @annevk.
-
Stringification of TrustedHTML with `null`-data needs to be specified w3c/trusted-types#469, by @ghost.
-
Why is "callback **this** value set to null" required in step 5 of "Get Trusted Type policy value"? w3c/trusted-types#468, by @ghost.
-
Is parseFromString where the type is "application/xml" an actual risk? w3c/trusted-types#467, by @technion.
-
-
7 issues closed.
-
Broken references in Trusted Types w3c/trusted-types#378.
-
Function constructor and default policy w3c/trusted-types#458.
-
HTML timers as specced won't work w3c/trusted-types#480.
-
Missing test for SVG href and getAttributeType function w3c/trusted-types#463.
-
Is parseFromString where the type is "application/xml" an actual risk? w3c/trusted-types#467.
-
Create a Trusted Type Policy seems to directly set properties to callbacks w3c/trusted-types#470.
-
-
2 issues reopened.
-
Ensure spec PR's diffs are generated correctly w3c/trusted-types#455.
-
Improve test coverage for DOM integration in WPT w3c/trusted-types#425.
-
-
22 issues received 67 new comments.
-
Can we drop the default policy value changing from Eval, new Function() (and other usages of the dynamic code brand checks proposal)? w3c/trusted-types#461 (11 comments by @caridy, @ghost, @koto, @lukewarlow, @otherdaniel)
-
"Validate the string in context" takes any value and calls "Get Trusted Type compliant string" which requires a TrustedType or a string w3c/trusted-types#488 (9 comments by @annevk, @ghost, @lukewarlow)
-
Stringification of TrustedHTML with `null`-data needs to be specified w3c/trusted-types#469 (9 comments by @annevk, @ghost)
-
Creating a policy with policyName="" is possible, but can't be referred to by the "trusted-types" CSP directive w3c/trusted-types#466 (6 comments by @bkardell, @ghost, @koto, @lukewarlow, @otherdaniel)
-
Is parseFromString where the type is "application/xml" an actual risk? w3c/trusted-types#467 (3 comments by @annevk, @Sora2455, @technion)
-
Maybe remove plugin enforcement from Trusted Types? w3c/trusted-types#305 (2 comments by @koto, @lukewarlow)
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221 (2 comments by @annevk, @caridy)
-
Ensure spec PR's diffs are generated correctly w3c/trusted-types#455 (2 comments by @annevk, @ghost)
-
Developer-centric research results about Trusted Types w3c/trusted-types#471 (2 comments by @annevk, @caridy)
-
Create a Trusted Type Policy seems to directly set properties to callbacks w3c/trusted-types#470 (2 comments by @annevk, @lukewarlow)
-
Why is "callback **this** value set to null" required in step 5 of "Get Trusted Type policy value"? w3c/trusted-types#468 (1 comment by @petervanderbeken)
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (1 comment by @lukewarlow)
-
-
14 pull requests opened.
-
Remove outdated event handler section w3c/trusted-types#495, by @lukewarlow.
-
Make sink an argument to get tt compliant attribute value w3c/trusted-types#493, by @lukewarlow.
-
Add missing HostEnsureCanCompileStrings monkeypatch w3c/trusted-types#490, by @lukewarlow.
-
Remove changes upstreamed to DOM Parsing w3c/trusted-types#489, by @lukewarlow.
-
Remove changes upstreamed to SVG w3c/trusted-types#487, by @lukewarlow.
-
Remove enforcement from embed and object elements w3c/trusted-types#486, by @lukewarlow.
-
Remove IDL changes upstreamed to HTML w3c/trusted-types#485, by @lukewarlow.
-
Update IDL for script enforcement w3c/trusted-types#484, by @lukewarlow.
-
Update handling of timer functions w3c/trusted-types#481, by @lukewarlow.
-
Add export attr to [[Data]] slot dfns w3c/trusted-types#479, by @lukewarlow.
-
Add dfn for [[Data]] internal slot w3c/trusted-types#478, by @lukewarlow.
-
Correct the location of some IDL w3c/trusted-types#477, by @lukewarlow.
-
Replace WebIDL section with a link to new PR w3c/trusted-types#475, by @lukewarlow.
-
Add new `trusted-eval` source expression to 'script-src' directive. w3c/trusted-types#473, by @lukewarlow.
-
-
11 pull requests merged.
-
Update handling of timer functions w3c/trusted-types#481.
-
Add missing HostEnsureCanCompileStrings monkeypatch w3c/trusted-types#490.
-
Remove IDL changes upstreamed to HTML w3c/trusted-types#485.
-
Remove changes upstreamed to SVG w3c/trusted-types#487.
-
Remove changes upstreamed to DOM Parsing w3c/trusted-types#489.
-
Correct the location of some IDL w3c/trusted-types#477.
-
Add export attr to [[Data]] slot dfns w3c/trusted-types#479.
-
Replace WebIDL section with a link to new PR w3c/trusted-types#475.
-
Add dfn for [[Data]] internal slot w3c/trusted-types#478.
-
Update support for dynamic code compilation w3c/trusted-types#464.
-
Remove default policy manipulating eval w3c/trusted-types#465.
-
-
1 pull request closed.
-
Add missing IDL changes to Parent and Child Node mixins from dom spec w3c/trusted-types#440.
-
-
8 pull requests received 53 new comments.
-
Update IDL for script enforcement w3c/trusted-types#484 (14 comments by @annevk, @koto, @lukewarlow, @smaug----)
-
Make sink an argument to get tt compliant attribute value w3c/trusted-types#493 (4 comments by @lukewarlow)
-
Remove enforcement from embed and object elements w3c/trusted-types#486 (4 comments by @koto, @lukewarlow)
-
Add new `trusted-eval` source expression to 'script-src' directive. w3c/trusted-types#473 (3 comments by @lukewarlow)
-
Add missing IDL changes to Parent and Child Node mixins from dom spec w3c/trusted-types#440 (2 comments by @lukewarlow)
w3c/webcrypto
-
2 issues received 2 new comments.
-
1 pull request received 3 new comments.
w3c/webappsec-dbsc
-
3 issues opened.
-
In startsession we deliver authorization artifact in two different ways w3c/webappsec-dbsc#19, by @alextok.
-
Origin trial updates w3c/webappsec-dbsc#17, by @kmonsen.
-
Diagram mismatch w3c/webappsec-dbsc#16, by @alextok.
-
-
1 issue closed.
-
Diagram mismatch w3c/webappsec-dbsc#16.
-
-
4 issues received 14 new comments.
-
The scheme is a little bit redundant for a redirect-based auth w3c/webappsec-dbsc#12 (4 comments by @alextok, @mattjm)
-
In startsession we deliver authorization artifact in two different ways w3c/webappsec-dbsc#19 (2 comments by @kmonsen, @mattjm)
-
1 pull request opened.
-
Update the header to sec-session-registration w3c/webappsec-dbsc#18, by @appsdesh.
-
-
1 pull request merged.
-
Update the header to sec-session-registration w3c/webappsec-dbsc#18.
-
-
1 pull request received 3 new comments.
w3c/webappsec-passkey-endpoints
-
1 pull request opened.
-
Fix some of the doc metadata w3c/webappsec-passkey-endpoints#4, by @dontcallmedom.
-
w3c/webappsec
-
3 issues opened.
-
Planning the 2024-04-17. w3c/webappsec#648, by @mikewest.
-
"End-to-End Encryption email" is missing an actual proposal w3c/webappsec#646, by @plehegar.
-
Move OTR to Privacy Working Group w3c/webappsec#645, by @plehegar.
-
-
6 issues closed.
-
"UI Security" is not the correct Shortname w3c/webappsec#553.
-
2021-2023 charter feedback w3c/webappsec#595.
-
Stop advising to people use the mailing list w3c/webappsec#602.
-
Planning 2024-01-17. w3c/webappsec#638.
-
Planning the 2024-03-20 meeting w3c/webappsec#643.
-
Move OTR to Privacy Working Group w3c/webappsec#645.
-
-
1 issue reopened.
-
"End-to-End Encryption email" is missing an actual proposal w3c/webappsec#646, by @plehegar.
-
-
6 issues received 24 new comments.
-
Move OTR to Privacy Working Group w3c/webappsec#645 (9 comments by @mikewest, @plehegar, @ShivanKaul)
-
Planning the 2024-03-20 meeting w3c/webappsec#643 (7 comments by @aaronshim, @lukewarlow, @mikewest, @plehegar)
-
"End-to-End Encryption email" is missing an actual proposal w3c/webappsec#646 (4 comments by @marcoscaceres, @plehegar)
-
-
1 pull request opened.
-
Removes Request-OTR from charter w3c/webappsec#647, by @plehegar.
-
-
2 pull requests merged.
-
Initial Content for the W3C WebAppSec WG Mitigations Wiki w3c/webappsec#639.
-
Removes Request-OTR from charter w3c/webappsec#647.
-
-
1 pull request received 9 new comments.
-
Initial Content for the W3C WebAppSec WG Mitigations Wiki w3c/webappsec#639 (9 comments by @aaronshim, @mikewest, @sideshowbarker, @simon-friedberger, @simoneonofri, @wbamberg)
-
w3c/webappsec-cspee
-
1 pull request opened.
-
Add Trusted Types support to CSP Embedded Enforcement w3c/webappsec-cspee#29, by @shhnjk.
-
-
1 pull request received 2 new comments.
-
Add Trusted Types support to CSP Embedded Enforcement w3c/webappsec-cspee#29 (2 comments by @antosart, @shhnjk)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
Common checks w3c/webappsec-credential-management#228, by @marcoscaceres.
-
Reaction/recheck to non-fully active documents w3c/webappsec-credential-management#227, by @marcoscaceres.
-
-
1 issue received 2 new comments.
-
Reaction/recheck to non-fully active documents w3c/webappsec-credential-management#227 (2 comments by @marcoscaceres)
-
-
1 pull request received 1 new comment.
-
Add mediation to credential creation options w3c/webappsec-credential-management#224 (1 comment by @pascoej)
-
w3c/permissions
-
1 issue opened.
-
Dynamic options for "prompt the user to choose" w3c/permissions#447, by @reillyeon.
-
-
3 issues closed.
-
WebDriver BiDi: support user contexts in setPermission w3c/permissions#439.
-
Align internal states with enums w3c/permissions#392.
-
Turn PermissionSetParameters.descriptor into an object w3c/permissions#443.
-
-
1 pull request opened.
-
Editorial: fix wrong cddl syntax used for optionality of the user context w3c/permissions#448, by @OrKoN.
-
-
4 pull requests merged.
-
Editorial: fix wrong cddl syntax used for optionality of the user context w3c/permissions#448.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438.
-
Editorial: define permission states consistently w3c/permissions#400.
-
Use `object` for PermissionSetParameters.descriptor w3c/permissions#444.
-
-
1 pull request closed.
-
Add additional automation error checks w3c/permissions#402.
-
-
6 pull requests received 11 new comments.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438 (4 comments by @miketaylr, @OrKoN)
-
Use `object` for PermissionSetParameters.descriptor w3c/permissions#444 (3 comments by @marcoscaceres, @miketaylr)
-
Editorial: fix wrong cddl syntax used for optionality of the user context w3c/permissions#448 (1 comment by @OrKoN)
-
w3c/permissions#446 (1 comment by @w3cbot)
-
w3c/permissions#445 (1 comment by @w3cbot)
-
w3c/webappsec-referrer-policy
-
1 pull request received 1 new comment.
-
Omit referrers on cross-origin requests from an .onion address w3c/webappsec-referrer-policy#156 (1 comment by @domfarolino)
-
w3c/webappsec-mixed-content
-
1 issue opened.
-
Unlawful Server Access w3c/webappsec-mixed-content#69, by @rogtheman.
-
-
1 issue closed.
-
Unlawful Server Access w3c/webappsec-mixed-content#69.
-
Lifecycle
-
1 charter extension.
-
Charter extended until 30 April 2024.
-
TR publications
-
3 documents published.
-
Credential Management Level 1 published as a Working Draft. History of Credential Management Level 1
-
Content Security Policy Level 3 published as a Working Draft. History of Content Security Policy Level 3
-
Permissions published as a Working Draft. History of Permissions
-
Participants
-
1 participant joined.
-
Tim Cappalli (Okta) joined.
-
-
1 participant left.
-
Maitane Zotes (Cloudflare) left.
-
-
1 organization joined.
-
Okta joined.
-
GitHub
w3c/webappsec-csp
-
4 issues opened.
-
Google Analytics URLs w3c/webappsec-csp#648, by @cristiandelgadod.
-
Confusion revolving around sandbox 'allow-top-navigation' directive w3c/webappsec-csp#647, by @franklyn07.
-
[TIMING] references broken w3c/webappsec-csp#644, by @bkardell.
-
"Is element nonceable" not applied to non-<script> elements in Chrome? w3c/webappsec-csp#643, by @evilpie.
-
-
3 issues closed.
-
[TIMING] references broken w3c/webappsec-csp#644.
-
Problem with SecurityPolicyViolationEvent constructor and optional init dict w3c/webappsec-csp#631.
-
-
3 issues received 6 new comments.
-
Problem with SecurityPolicyViolationEvent constructor and optional init dict w3c/webappsec-csp#631 (2 comments by @antosart, @SaeidEid)
-
Why is the Content-Security-Policy-Report-Only header field not supported in `<meta>` elements? w3c/webappsec-csp#640 (2 comments by @annevk, @gapple)
-
-
3 pull requests opened.
-
Fix reference link for [TIMING] w3c/webappsec-csp#646, by @antosart.
-
Remove required condition on the attributes fror SecurityPolicyViolationEventInit dict w3c/webappsec-csp#645, by @SaeidEid.
-
Add `[SecureContext]` tag to the interfaces w3c/webappsec-csp#642, by @OnkarRuikar.
-
-
2 pull requests merged.
-
Fix reference link for [TIMING] w3c/webappsec-csp#646.
-
Remove required condition on the attributes fror SecurityPolicyViolationEventInit dict w3c/webappsec-csp#645.
-
-
1 pull request received 1 new comment.
w3c/trusted-types
-
23 issues opened.
-
Missing test for SVG href and getAttributeType function w3c/trusted-types#463, by @lukewarlow.
-
Trusted Types closure to replace fallback policy w3c/trusted-types#462, by @lukewarlow.
-
Why are `policyOptions` an optional argument of `createPolicy`? w3c/trusted-types#459, by @ghost.
-
Function constructor and default policy w3c/trusted-types#458, by @lukewarlow.
-
`getPropertyType()` needs a rewrite? w3c/trusted-types#456, by @lukewarlow.
-
Ensure spec PR's diffs are generated correctly w3c/trusted-types#455, by @ghost.
-
Consider deleting the master branch as it's superseded by the main branch w3c/trusted-types#452, by @ghost.
-
Is there a convenient way to see the rendered diff a spec PR? w3c/trusted-types#451, by @ghost.
-
Add test for `setAttributeNS` with an event handler w3c/trusted-types#448, by @ghost.
-
<Element-setAttributeNS.html> contains commented out test and seems to duplicate other tests w3c/trusted-types#447, by @ghost.
-
Should the polyfill be moved? w3c/trusted-types#444, by @lukewarlow.
-
Integration with Shadow Realms? w3c/trusted-types#442, by @lukewarlow.
-
Integration with DOM Parts API w3c/trusted-types#441, by @lukewarlow.
-
Integration with DOM APIs w3c/trusted-types#438, by @lukewarlow.
-
Issue with script enforcement w3c/trusted-types#437, by @lukewarlow.
-
"Prepare the script URL and text" algorithm badly named w3c/trusted-types#435, by @lukewarlow.
-
Should the "default" policy be called when `setAttributeNode` is called with a node from the same realm? w3c/trusted-types#434, by @ghost.
-
TrustedTypePolicyFactory getTypeMapping() missing from spec. w3c/trusted-types#432, by @lukewarlow.
-
Discrepency between tests and Get Trusted Type Compliant string algorithm w3c/trusted-types#431, by @lukewarlow.
-
There's a lack of test coverage over the namespace aspect of getPropertyType w3c/trusted-types#429, by @lukewarlow.
-
-
11 issues closed.
-
Why are `policyOptions` an optional argument of `createPolicy`? w3c/trusted-types#459.
-
Consider deleting the master branch as it's superseded by the main branch w3c/trusted-types#452.
-
Is there a convenient way to see the rendered diff a spec PR? w3c/trusted-types#451.
-
"Prepare the script URL and text" algorithm badly named w3c/trusted-types#435.
-
TrustedHTML.fromLiteral is exposed in workers but assumes the current global is a Window w3c/trusted-types#374.
-
Are `getAttributeType` and `getPropertyType` methods neccessary? w3c/trusted-types#384.
-
Discrepency between tests and Get Trusted Type Compliant string algorithm w3c/trusted-types#431.
-
Figure out what to do with `script.setAttribute('src')` w3c/trusted-types#402.
-
Is the `[[ScriptURL]]` slot needed? w3c/trusted-types#401.
-
-
2 issues reopened.
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221, by @lukewarlow.
-
Clarify interaction between unsafe-eval and TrustedScript. w3c/trusted-types#143, by @lukewarlow.
-
-
26 issues received 85 new comments.
-
Issue with script enforcement w3c/trusted-types#437 (13 comments by @ghost, @koto, @lukewarlow, @otherdaniel)
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (8 comments by @caridy, @lukewarlow, @ptomato)
-
Integration with Shadow Realms? w3c/trusted-types#442 (8 comments by @caridy, @lukewarlow, @mhofman, @nicolo-ribaudo)
-
Trusted Types closure to replace fallback policy w3c/trusted-types#462 (6 comments by @koto, @lukewarlow, @Sora2455)
-
Discrepency between tests and Get Trusted Type Compliant string algorithm w3c/trusted-types#431 (5 comments by @koto, @lukewarlow)
-
TrustedTypePolicyFactory getTypeMapping() missing from spec. w3c/trusted-types#432 (4 comments by @koto, @lukewarlow, @petervanderbeken)
-
Figure out if we need `'trusted-script'` in `script-src` w3c/trusted-types#221 (3 comments by @caridy, @lukewarlow)
-
Can we drop the default policy value changing from Eval, new Function() (and other usages of the dynamic code brand checks proposal)? w3c/trusted-types#461 (3 comments by @koto, @lukewarlow)
-
Ensure spec PR's diffs are generated correctly w3c/trusted-types#455 (3 comments by @domenic, @ghost, @koto)
-
Should the "default" policy be called when `setAttributeNode` is called with a node from the same realm? w3c/trusted-types#434 (3 comments by @ghost, @koto)
-
<Element-setAttributeNS.html> contains commented out test and seems to duplicate other tests w3c/trusted-types#447 (2 comments by @lukewarlow)
-
Why are `policyOptions` an optional argument of `createPolicy`? w3c/trusted-types#459 (2 comments by @ghost, @koto)
-
Can lowercasing be removed from getAttributeType()? w3c/trusted-types#424 (2 comments by @lukewarlow)
-
Add test to <block-string-assignment-to-Element-setAttribute.html> which checks trusted types can be assigned to non-injection sinks w3c/trusted-types#449 (2 comments by @ghost)
-
Are `getAttributeType` and `getPropertyType` methods neccessary? w3c/trusted-types#384 (2 comments by @lukewarlow, @mozfreddyb)
-
Figure out what to do with `script.setAttribute('src')` w3c/trusted-types#402 (2 comments by @koto, @lukewarlow)
-
Improve test coverage for DOM integration in WPT w3c/trusted-types#425 (2 comments by @ghost, @koto)
-
Missing test for SVG href and getAttributeType function w3c/trusted-types#463 (1 comment by @lukewarlow)
-
Consider deleting the master branch as it's superseded by the main branch w3c/trusted-types#452 (1 comment by @koto)
-
Clarify interaction between unsafe-eval and TrustedScript. w3c/trusted-types#143 (1 comment by @lukewarlow)
-
Either remove `fromLiteral` from v1 of the spec or add a note to the spec that it'll be implemented later w3c/trusted-types#412 (1 comment by @lukewarlow)
-
-
14 pull requests opened.
-
Remove default policy manipulating eval w3c/trusted-types#465, by @lukewarlow.
-
Update support for dynamic code compilation w3c/trusted-types#464, by @lukewarlow.
-
Fix IDL of getAttributeType and getPropertyType w3c/trusted-types#460, by @lukewarlow.
-
Rewrite metadata functions w3c/trusted-types#457, by @lukewarlow.
-
Extract `Does sink type require trusted types?` to its own algorithm w3c/trusted-types#450, by @lukewarlow.
-
Remove superfluous condition w3c/trusted-types#446, by @lukewarlow.
-
Update dynamic code compilation support w3c/trusted-types#445, by @lukewarlow.
-
Remove pre-commit hooks w3c/trusted-types#443, by @lukewarlow.
-
Add missing IDL changes to Parent and Child Node mixins from dom spec w3c/trusted-types#440, by @lukewarlow.
-
Make gitignore more exhaustive w3c/trusted-types#439, by @lukewarlow.
-
Rename prepare script url and text algorithm w3c/trusted-types#436, by @lukewarlow.
-
Fix issue with default policy handling when callback function is missing w3c/trusted-types#433, by @lukewarlow.
-
Remove outdated inline issue w3c/trusted-types#430, by @lukewarlow.
-
Add missing stringify when passing source to CSP algorithm w3c/trusted-types#428, by @lukewarlow.
-
-
11 pull requests merged.
-
Update dynamic code compilation support w3c/trusted-types#445.
-
Extract `Does sink type require trusted types?` to its own algorithm w3c/trusted-types#450.
-
Remove superfluous condition w3c/trusted-types#446.
-
Make gitignore more exhaustive w3c/trusted-types#439.
-
Remove pre-commit hooks w3c/trusted-types#443.
-
Rename prepare script url and text algorithm w3c/trusted-types#436.
-
Remove `fromLiteral` from spec. w3c/trusted-types#405.
-
Fix issue with default policy handling when callback function is missing w3c/trusted-types#433.
-
Remove outdated inline issue w3c/trusted-types#430.
-
Rewrote DOM integration w3c/trusted-types#418.
-
Add missing stringify when passing source to CSP algorithm w3c/trusted-types#428.
-
-
7 pull requests received 49 new comments.
-
Add missing IDL changes to Parent and Child Node mixins from dom spec w3c/trusted-types#440 (16 comments by @ghost, @koto, @lukewarlow)
-
Extract `Does sink type require trusted types?` to its own algorithm w3c/trusted-types#450 (7 comments by @ghost, @koto, @lukewarlow)
-
w3c/permissions
-
2 issues opened.
-
Turn PermissionSetParameters.descriptor into an object w3c/permissions#443, by @saschanaz.
-
Disambiguate "parameters" in Set Permission steps w3c/permissions#440, by @saschanaz.
-
-
2 issues closed.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414.
-
Disambiguate "parameters" in Set Permission steps w3c/permissions#440.
-
-
1 issue received 1 new comment.
-
Add another permission state "always-ask" (from one-time grants)? w3c/permissions#414 (1 comment by @jan-ivar)
-
-
2 pull requests opened.
-
Use `object` for PermissionSetParameters.descriptor w3c/permissions#444, by @saschanaz.
-
Editorial: Disambiguate `parameters` in Set Permission steps w3c/permissions#441, by @saschanaz.
-
-
1 pull request merged.
-
Editorial: Disambiguate `parameters` in Set Permission steps w3c/permissions#441.
-
-
1 pull request reopened.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438, by @OrKoN.
-
-
3 pull requests received 8 new comments.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438 (6 comments by @miketaylr, @OrKoN)
-
w3c/permissions#442 (1 comment by @w3cbot)
-
Editorial: Disambiguate `parameters` in Set Permission steps w3c/permissions#441 (1 comment by @miketaylr)
-
w3c/webappsec-permissions-policy
-
2 issues opened.
-
[clipboard] document.execCommand('copy') and presumably paste bypass permissions policy w3c/webappsec-permissions-policy#543, by @williewillus.
-
Query: Can trusted subframe allocate permission to one of it's cross-domain subframe w3c/webappsec-permissions-policy#542, by @aromalanil.
-
-
2 issues closed.
-
Permissions Policy report missing a document URL w3c/webappsec-permissions-policy#536.
-
-
7 issues received 27 new comments.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#537 (11 comments by @annevk, @arturjanc, @clelland, @shhnjk)
-
Proposal: Transition 'sync-xhr' feature to Document Policy w3c/webappsec-permissions-policy#410 (6 comments by @arturjanc, @RByers, @yoavweiss)
-
Disable DOM clobbering. w3c/webappsec-permissions-policy#349 (4 comments by @annevk, @mozfreddyb, @securityMB)
-
Query: Can trusted subframe allocate permission to one of it's cross-domain subframe w3c/webappsec-permissions-policy#542 (2 comments by @aromalanil, @clelland)
-
Permissions Policy report missing a document URL w3c/webappsec-permissions-policy#536 (2 comments by @clelland, @shhnjk)
-
-
1 pull request opened.
-
Add `documentUrl` to Permissions Policy report w3c/webappsec-permissions-policy#541, by @shhnjk.
-
-
1 pull request closed.
-
Add `documentUrl` to Permissions Policy report w3c/webappsec-permissions-policy#541.
-
-
1 pull request received 1 new comment.
-
Add `documentUrl` to Permissions Policy report w3c/webappsec-permissions-policy#541 (1 comment by @shhnjk)
-
w3c/webappsec-credential-management
-
2 issues opened.
-
Please PLEASE please auto-publish this spec w3c/webappsec-credential-management#226, by @marcoscaceres.
-
Mediation parameter for credential creation w3c/webappsec-credential-management#225, by @pascoej.
-
-
1 issue closed.
-
Please PLEASE please auto-publish this spec w3c/webappsec-credential-management#226.
-
-
1 issue received 4 new comments.
-
Please PLEASE please auto-publish this spec w3c/webappsec-credential-management#226 (4 comments by @marcoscaceres, @nsatragno)
-
-
1 pull request received 5 new comments.
-
Add mediation to credential creation options w3c/webappsec-credential-management#224 (5 comments by @nsatragno, @pascoej)
-
w3c/webappsec
-
1 issue opened.
-
Planning the 2024-03-20 meeting w3c/webappsec#643, by @dveditz.
-
-
1 issue received 3 new comments.
-
1 pull request opened.
-
Fix typo in charter 2023 w3c/webappsec#644, by @dontcallmedom.
-
-
1 pull request merged.
-
Fix typo in charter 2023 w3c/webappsec#644.
-
w3c/webcrypto
-
1 issue opened.
-
bugged out w3c/webcrypto#363, by @Influ1877.
-
-
1 issue closed.
-
bugged out w3c/webcrypto#363.
-
-
1 issue received 1 new comment.
-
1 pull request opened.
-
Add Curve25519 w3c/webcrypto#362, by @twiss.
-
-
2 pull requests received 15 new comments.
-
Make deriveBits length parameter optional and nullable w3c/webcrypto#345 (1 comment by @javifernandez)
w3c/webappsec-secure-contexts
-
1 issue received 2 new comments.
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (2 comments by @aerik, @drzraf)
-
w3c/webappsec-clear-site-data
-
1 pull request opened.
-
Add compression dictionary clearing support w3c/webappsec-clear-site-data#80, by @horo-t.
-
-
1 pull request received 3 new comments.
-
Add compression dictionary clearing support w3c/webappsec-clear-site-data#80 (3 comments by @horo-t, @pmeenan)
-
TR publications
-
4 documents published.
-
Content Security Policy Level 3 published twice as a Working Draft. History of Content Security Policy Level 3
-
Permissions published twice as a Working Draft. History of Permissions
-
Past meetings
-
1 meeting.
Participants
-
3 participants joined.
-
Mirko Brodesser (Igalia) joined.
-
Saurav Bhattacharya (Microsoft Corporation) joined.
-
Leonardo Balter (Salesforce) joined.
-
-
2 participants left.
-
Tim Cappalli (Okta) left.
-
Samuel Weiler (W3C) left.
-
-
1 organization joined.
-
Salesforce joined.
-
GitHub
w3c/webappsec-permissions-policy
-
4 issues opened.
-
Send reports for Permissions Policy violations in iframe to parent frame's endpoint w3c/webappsec-permissions-policy#537, by @shhnjk.
-
Permissions Policy report missing a document URL w3c/webappsec-permissions-policy#536, by @shhnjk.
-
methiyaowala w3c/webappsec-permissions-policy#535, by @Usermsn.
-
1 issue closed.
-
methiyaowala w3c/webappsec-permissions-policy#535.
-
-
1 issue received 1 new comment.
w3c/webappsec-credential-management
-
1 pull request received 9 new comments.
-
Add mediation to credential creation options w3c/webappsec-credential-management#224 (9 comments by @nsatragno)
-
w3c/permissions
-
3 issues opened.
-
WebDriver BiDi: support user contexts in setPermission w3c/permissions#439, by @OrKoN.
-
WebDriver: Should Set Permission apply to future browsing contexts? w3c/permissions#437, by @OrKoN.
-
Broken references in Permissions w3c/permissions#433, by @dontcallmedom-bot.
-
-
2 issues closed.
-
Broken references in Permissions w3c/permissions#433.
-
Umbrella / Meta: Browser Permissions for WebDriver BiDi as an extension module w3c/permissions#424.
-
-
2 issues received 3 new comments.
-
WebDriver: Make it possible to pass a different origin to "Set Permission" w3c/permissions#419 (2 comments by @miketaylr, @OrKoN)
-
-
4 pull requests opened.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438, by @OrKoN.
-
Require an explicit origin for WebDriver BiDi automation w3c/permissions#436, by @OrKoN.
-
Editorial: Update link to accelerometer permission w3c/permissions#435, by @OrKoN.
-
Editorial: fix tidy errors w3c/permissions#434, by @OrKoN.
-
-
4 pull requests merged.
-
Require an explicit origin for WebDriver BiDi automation w3c/permissions#436.
-
Editorial: fix tidy errors w3c/permissions#434.
-
Editorial: Update link to accelerometer permission w3c/permissions#435.
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#431.
-
-
2 pull requests reopened.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438, by @OrKoN.
-
Add userContext field to WebDriver BiDi's setPermission w3c/permissions#438, by @OrKoN.
-
-
5 pull requests received 17 new comments.
-
Require an explicit origin for WebDriver BiDi automation w3c/permissions#436 (8 comments by @marcoscaceres, @miketaylr, @OrKoN)
-
Introduce Browser Permissions for WebDriver BiDi w3c/permissions#431 (3 comments by @miketaylr, @OrKoN)
-
w3c/trusted-types
-
27 issues opened.
-
Duplication of some tests w3c/trusted-types#426, by @lukewarlow.
-
Improve test coverage for DOM integration in WPT w3c/trusted-types#425, by @koto.
-
Can lowercasing be removed from getAttributeType()? w3c/trusted-types#424, by @annevk.
-
getAttributeType() needs a rewrite w3c/trusted-types#423, by @annevk.
-
Can we add no-op/report? w3c/trusted-types#421, by @bkardell.
-
Ensure at least one representative of all classes of injection sinks is guarded with TT w3c/trusted-types#419, by @ghost.
-
Create pull request template w3c/trusted-types#415, by @ghost.
-
CreateXXX as specced can return null values but not marked as such in IDL w3c/trusted-types#414, by @lukewarlow.
-
Process value with default policy missing step? w3c/trusted-types#413, by @lukewarlow.
-
Either remove `fromLiteral` from v1 of the spec or add a note to the spec that it'll be implemented later w3c/trusted-types#412, by @ghost.
-
Add `fromLiteral` w3c/trusted-types#411, by @ghost.
-
Missing integration with new unsafe HTML parsing methods w3c/trusted-types#403, by @lukewarlow.
-
Figure out what to do with `script.setAttribute('src')` w3c/trusted-types#402, by @lukewarlow.
-
Is the `[[ScriptURL]]` slot needed? w3c/trusted-types#401, by @lukewarlow.
-
Integration with WebIDL w3c/trusted-types#400, by @lukewarlow.
-
Is there agreement in the HTML-spec community that no new injection sinks will be added? w3c/trusted-types#399, by @ghost.
-
Defer `fromLiteral`? w3c/trusted-types#398, by @lukewarlow.
-
Defer integration with Dynamic Code Brand Checks? w3c/trusted-types#397, by @lukewarlow.
-
Incorrect assertion within Example 18 w3c/trusted-types#393, by @lukewarlow.
-
[infra] This repositories GitHub actions are broken w3c/trusted-types#390, by @lukewarlow.
-
Mismatch between spec IDL and Chromium implementation for TrustedTypePolicyOptions w3c/trusted-types#388, by @lukewarlow.
-
Are `TrustedTypePolicy`'s `create*` methods intentionally not `readonly`? w3c/trusted-types#386, by @ghost.
-
Are all injection sinks covered by the spec? w3c/trusted-types#385, by @ghost.
-
Are `getAttributeType` and `getPropertyType` methods neccessary? w3c/trusted-types#384, by @lukewarlow.
-
Should `require-trusted-types-for` support trusted scripts and trusted script URLs? w3c/trusted-types#383, by @ghost.
-
-
20 issues closed.
-
CreateXXX as specced can return null values but not marked as such in IDL w3c/trusted-types#414.
-
Process value with default policy missing step? w3c/trusted-types#413.
-
Defer `fromLiteral`? w3c/trusted-types#398.
-
Is there agreement in the HTML-spec community that no new injection sinks will be added? w3c/trusted-types#399.
-
TrustedTypes bypass using iframes w3c/trusted-types#380.
-
Consider enforcing TT for custom attributes. w3c/trusted-types#288.
-
Consider adding a type for base.href w3c/trusted-types#172.
-
Expose information on status of TrustedTypes enforcement w3c/trusted-types#36.
-
'Create a Trusted Type' algorithm returns error value in step 6 w3c/trusted-types#382.
-
Incorrect assertion within Example 18 w3c/trusted-types#393.
-
Add SVG <use> href attribute to Trusted Types enforcement w3c/trusted-types#357.
-
Are `TrustedTypePolicy`'s `create*` methods intentionally not `readonly`? w3c/trusted-types#386.
-
Missing integration with new unsafe HTML parsing methods w3c/trusted-types#403.
-
Should `require-trusted-types-for` support trusted scripts and trusted script URLs? w3c/trusted-types#383.
-
Defer integration with Dynamic Code Brand Checks? w3c/trusted-types#397.
-
Handle innerHTML of svg in IE w3c/trusted-types#223.
-
CfC to publish as an FPWD. w3c/trusted-types#342.
-
[infra] This repositories GitHub actions are broken w3c/trusted-types#390.
-
Mismatch between spec IDL and Chromium implementation for TrustedTypePolicyOptions w3c/trusted-types#388.
-
-
2 issues reopened.
-
Are `getAttributeType` and `getPropertyType` methods neccessary? w3c/trusted-types#384, by @mozfreddyb.
-
Maybe remove plugin enforcement from Trusted Types? w3c/trusted-types#305, by @annevk.
-
-
39 issues received 152 new comments.
-
Defer `fromLiteral`? w3c/trusted-types#398 (27 comments by @caridy, @ghost, @koto, @lukewarlow, @shhnjk, @Sora2455)
-
Are all injection sinks covered by the spec? w3c/trusted-types#385 (20 comments by @annevk, @ghost, @koto, @lukewarlow, @mozfreddyb)
-
Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207 (8 comments by @ghost, @koto, @lukewarlow)
-
Are `TrustedTypePolicy`'s `create*` methods intentionally not `readonly`? w3c/trusted-types#386 (8 comments by @ghost, @koto, @smaug----)
-
Can we add no-op/report? w3c/trusted-types#421 (7 comments by @bkardell, @ghost, @koto, @lukewarlow, @Sora2455)
-
Should `require-trusted-types-for` support trusted scripts and trusted script URLs? w3c/trusted-types#383 (7 comments by @ghost, @koto, @lukewarlow)
-
should `null` & `undefined` for sinks requiring TT be a passthrough ? w3c/trusted-types#379 (6 comments by @ghost, @koto, @lukewarlow)
-
Are `getAttributeType` and `getPropertyType` methods neccessary? w3c/trusted-types#384 (5 comments by @lukewarlow, @mozfreddyb, @tosmolka)
-
Is there agreement in the HTML-spec community that no new injection sinks will be added? w3c/trusted-types#399 (5 comments by @ghost, @lukewarlow, @mozfreddyb)
-
Adressing cross-document vectors comprehensively relies on "origin-policy" which is a proposal which is on hold w3c/trusted-types#422 (4 comments by @ghost, @koto)
-
CreateXXX as specced can return null values but not marked as such in IDL w3c/trusted-types#414 (4 comments by @koto, @lukewarlow)
-
Maybe remove plugin enforcement from Trusted Types? w3c/trusted-types#305 (4 comments by @annevk, @koto)
-
Add SVG <use> href attribute to Trusted Types enforcement w3c/trusted-types#357 (4 comments by @koto, @mozfreddyb, @shhnjk)
-
Defer integration with Dynamic Code Brand Checks? w3c/trusted-types#397 (4 comments by @koto, @lukewarlow)
-
Improve test coverage for DOM integration in WPT w3c/trusted-types#425 (3 comments by @ghost, @koto, @lukewarlow)
-
Can we conditionally enforce Trusted Types based on document response type in XHR? w3c/trusted-types#360 (3 comments by @annevk, @koto)
-
getAttributeType and getPropertyType should default to HTML namespace, not "" w3c/trusted-types#381 (2 comments by @koto, @lukewarlow)
-
Ensure at least one representative of all classes of injection sinks is guarded with TT w3c/trusted-types#419 (2 comments by @ghost, @koto)
-
[infra] This repositories GitHub actions are broken w3c/trusted-types#390 (2 comments by @ghost, @koto)
-
Mismatch between spec IDL and Chromium implementation for TrustedTypePolicyOptions w3c/trusted-types#388 (2 comments by @koto, @lukewarlow)
-
https://github.com/w3c/trusted-types/blob/main/CONTRIBUTING.md requires documentation how to locally generate the spec's HTML w3c/trusted-types#392 (2 comments by @ghost, @lukewarlow)
-
Either remove `fromLiteral` from v1 of the spec or add a note to the spec that it'll be implemented later w3c/trusted-types#412 (1 comment by @lukewarlow)
-
Missing integration with new unsafe HTML parsing methods w3c/trusted-types#403 (1 comment by @lukewarlow)
-
JavaScript event for tracking (and blocking) policy creation w3c/trusted-types#270 (1 comment by @lukewarlow)
-
TrustedHTML.fromLiteral is exposed in workers but assumes the current global is a Window w3c/trusted-types#374 (1 comment by @lukewarlow)
-
'Create a Trusted Type' algorithm returns error value in step 6 w3c/trusted-types#382 (1 comment by @Md0135)
-
-
15 pull requests opened.
-
Move early abort in Get Trusted Type compliant string to step 1 w3c/trusted-types#427, by @lukewarlow.
-
Extract Get Trusted Type policy value algorithm w3c/trusted-types#420, by @lukewarlow.
-
Rewrote DOM integration w3c/trusted-types#418, by @koto.
-
Stringify input when trusted type w3c/trusted-types#417, by @lukewarlow.
-
Add WPT block to spec to display test link w3c/trusted-types#416, by @lukewarlow.
-
Changed incorrect error mention in Create a Trusted Type algorithm. w3c/trusted-types#410, by @koto.
-
Added a comment about fromLiteral. w3c/trusted-types#409, by @koto.
-
Merged HTML parsing sinks with DOM XSS sinks. w3c/trusted-types#407, by @koto.
-
Add integration with setHTMLUnsafe and parseHTMLUnsafe w3c/trusted-types#406, by @lukewarlow.
-
Remove `fromLiteral` from spec. w3c/trusted-types#405, by @lukewarlow.
-
Fix https://github.com/w3c/trusted-types/issues/388. w3c/trusted-types#395, by @koto.
-
Fixed bikeshed build. w3c/trusted-types#394, by @koto.
-
Removed commented out WPT Path Prefix from the metadata section w3c/trusted-types#391, by @koto.
-
Update callback IDL to return nullable types w3c/trusted-types#389, by @lukewarlow.
-
Correct identifier passed to StringContext attribute w3c/trusted-types#387, by @lukewarlow.
-
-
13 pull requests merged.
-
Move early abort in Get Trusted Type compliant string to step 1 w3c/trusted-types#427.
-
Extract Get Trusted Type policy value algorithm w3c/trusted-types#420.
-
Stringify input when trusted type w3c/trusted-types#417.
-
Add WPT block to spec to display test link w3c/trusted-types#416.
-
Changed incorrect error mention in Create a Trusted Type algorithm. w3c/trusted-types#410.
-
Added a comment about fromLiteral. w3c/trusted-types#409.
-
Add integration with setHTMLUnsafe and parseHTMLUnsafe w3c/trusted-types#406.
-
Merged HTML parsing sinks with DOM XSS sinks. w3c/trusted-types#407.
-
docs: Include repository field in package.json w3c/trusted-types#371.
-
Fix https://github.com/w3c/trusted-types/issues/388. w3c/trusted-types#395.
-
Update callback IDL to return nullable types w3c/trusted-types#389.
-
Fixed bikeshed build. w3c/trusted-types#394.
-
Correct identifier passed to StringContext attribute w3c/trusted-types#387.
-
-
2 pull requests closed.
-
Add detail about fromLiteral to explainer. w3c/trusted-types#377.
-
Removed commented out WPT Path Prefix from the metadata section w3c/trusted-types#391.
-
-
10 pull requests received 52 new comments.
-
w3c/trusted-types#408 (6 comments by @koto)
-
Add integration with setHTMLUnsafe and parseHTMLUnsafe w3c/trusted-types#406 (4 comments by @ghost, @lukewarlow)
-
w3c/trusted-types#404 (4 comments by @koto)
w3c/webappsec-secure-contexts
-
2 issues received 3 new comments.
-
localhost domains and HTTP/2 and beyond w3c/webappsec-secure-contexts#78 (2 comments by @aerik, @TomCJones)
-
Using secure-context gated features with local devices w3c/webappsec-secure-contexts#60 (1 comment by @aerik)
-
w3c/webappsec
-
1 issue received 2 new comments.
-
4 pull requests opened.
-
Tilt comments (part 2) w3c/webappsec#642, by @plehegar.
-
Tilt comments w3c/webappsec#641, by @plehegar.
-
Comments from PING on charter 2024 w3c/webappsec#640, by @plehegar.
-
Initial Content for the W3C WebAppSec WG Mitigations Wiki w3c/webappsec#639, by @aaronshim.
-
-
3 pull requests merged.
-
Tilt comments (part 2) w3c/webappsec#642.
-
Tilt comments w3c/webappsec#641.
-
Comments from PING on charter 2024 w3c/webappsec#640.
-
-
1 pull request received 1 new comment.
-
Initial Content for the W3C WebAppSec WG Mitigations Wiki w3c/webappsec#639 (1 comment by @mikewest)
-
w3c/webappsec-csp
-
4 issues opened.
-
Why is the Content-Security-Policy-Report-Only header field not supported in `<meta>` elements? w3c/webappsec-csp#640, by @ghost.
-
`service-worker-src` directive w3c/webappsec-csp#638, by @bakkot.
-
Does "Is Element Nonceable" apply to non-inline scripts? w3c/webappsec-csp#635, by @evilpie.
-
Chrome/Safari trim nonces w3c/webappsec-csp#634, by @evilpie.
-
-
1 issue closed.
-
CSP not working for certain hostnames w3c/webappsec-csp#620.
-
-
4 issues received 18 new comments.
-
Chrome/Safari trim nonces w3c/webappsec-csp#634 (11 comments by @annevk, @antosart, @evilpie, @mikewest)
-
Why is the Content-Security-Policy-Report-Only header field not supported in `<meta>` elements? w3c/webappsec-csp#640 (3 comments by @annevk, @ghost)
-
Resource hint blocking / "least restrictive" as specified does nothing? w3c/webappsec-csp#633 (3 comments by @antosart, @noamr)
-
Does "Is Element Nonceable" apply to non-inline scripts? w3c/webappsec-csp#635 (1 comment by @evilpie)
-
-
3 pull requests opened.
-
Add optional trailing dot to host-part w3c/webappsec-csp#639, by @SaeidEid.
-
Resource hint: check directives explicitly w3c/webappsec-csp#637, by @noamr.
-
Is-element-nonceable should check if the attribute's name |contains| <script or <style> w3c/webappsec-csp#636, by @evilpie.
-
-
2 pull requests merged.
-
Add optional trailing dot to host-part w3c/webappsec-csp#639.
-
Is-element-nonceable should check if the attribute's name |contains| <script or <style> w3c/webappsec-csp#636.
-
-
4 pull requests received 6 new comments.
-
Is-element-nonceable should check if the attribute's name |contains| <script or <style> w3c/webappsec-csp#636 (1 comment by @annevk)
w3c/webcrypto
-
1 issue received 4 new comments.
-
2 pull requests opened.
-
Allow using Crypto.getRandomValues() in Shadow Realms w3c/webcrypto#361, by @Ms2ger.
-
Fix the definition of SHA-512 w3c/webcrypto#360, by @twiss.
-
-
1 pull request received 3 new comments.
-
Allow using Crypto.getRandomValues() in Shadow Realms w3c/webcrypto#361 (3 comments by @annevk, @Ms2ger, @twiss)
-
w3c/webappsec-dbsc
-
4 issues opened.
-
key_registration_header.svg is hard to read when the reader's browser is dark mode. w3c/webappsec-dbsc#15, by @aawc.
-
Clarification of BFCache handling w3c/webappsec-dbsc#14, by @simon-friedberger.
-
Insufficient rationale w3c/webappsec-dbsc#13, by @simon-friedberger.
-
The scheme is a little bit redundant for a redirect-based auth w3c/webappsec-dbsc#12, by @alextok.
-
-
3 issues closed.
-
key_registration_header.svg is hard to read when the reader's browser is dark mode. w3c/webappsec-dbsc#15.
-
Support of different types of tokens is not clear w3c/webappsec-dbsc#11.
-
Start session can result in security bugs during implementation. w3c/webappsec-dbsc#7.
-
-
5 issues received 15 new comments.
-
The scheme is a little bit redundant for a redirect-based auth w3c/webappsec-dbsc#12 (8 comments by @alextok, @arnar, @kmonsen, @mattjm)
-
Support of different types of tokens is not clear w3c/webappsec-dbsc#11 (3 comments by @alextok, @arnar, @kmonsen)
-
key_registration_header.svg is hard to read when the reader's browser is dark mode. w3c/webappsec-dbsc#15 (2 comments by @aawc, @kmonsen)
-
Goal/Non-Goal definition has multiple interpretations. w3c/webappsec-dbsc#2 (1 comment by @simon-friedberger)
-
Start session can result in security bugs during implementation. w3c/webappsec-dbsc#7 (1 comment by @alextok)
-
w3c/webappsec-cspee
-
1 pull request received 1 new comment.
w3c/permissions-registry
-
1 issue opened.
-
Broken references in Permissions Registry w3c/permissions-registry#25, by @dontcallmedom-bot.
-