diff --git a/spec/index.bs b/spec/index.bs index 736dd30..0f74ca1 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -1508,108 +1508,9 @@ strings (|createdPolicyNames|), this algorithm returns `"Blocked"` if the `"Blocked"`. 1. Return |result|. -### Violation object changes ### {#csp-violation-object-hdr} - -[=violation|Violation=] object [=violation/resource=] also allows `"trusted-types-policy"` -and `"trusted-types-sink"` as values. - ### Support for dynamic code compilation ### {#csp-eval} -This document modifies the [[CSP3#can-compile-strings|EnsureCSPDoesNotBlockStringCompilation]] -which is reproduced in its entirety below with additions and deletions. - -Note: This is based on [dynamic-code-brand-checks](https://tc39.es/proposal-dynamic-code-brand-checks/). - -
Note: EcmaScript code may call `Function()` and `eval` cross realm. -
-  let f = new self.top.Function(source);
-
-In this case, the callerRealm's Window is `self` and the |calleeRealm|'s Window is `self.top`. -The Trusted Types portion of this algorithm uses |calleeRealm| and its CSP setting for consistency with other sinks. -
-  // Assigning a string to another Realm's DOM sink uses that Realm's default policy.
-  self.top.body.innerHTML = 'Hello, World!';
-  // Using another Realm's builtin Function constructor should analogously use that
-  // Realm's default policy.
-  new self.top.Function('alert(1)')()
-
-
- -Given a [[ECMA-262#realm|realm]] (|calleeRealm|), a list of strings (|parameterStrings|), a string (|bodyString|), an enum (|compilationType|), a list of ECMAScript language values (|parameterArgs|), and an ECMAScript language value (|bodyArg|), this algorithm returns normally if compilation is allowed, and -throws an "`EvalError`" if not: - -1. Let |source| be |bodyString|. -1. If |compilationType| is `*FUNCTION*`: - 1. Set |source| to `"function anonymous("` - 1. For each |arg| in |parameterStrings|: - 1. Append |arg| to |source|. - 1. If |arg| is not the last item of |parameterStrings|, append `","` to |source|. - 1. Append `"\n) {\n"` to |source|. - 1. Append |bodyString| to |source|. - 1. Append `"\n}"` to |source|. -1. If |compilationType| is `*TIMER*`, then: - 1. Let |sourceString| be |source|. -1. Else: - 1. Let |compilationSink| be `"Function"` if |compilationType| is `*FUNCTION*`, otherwise `"Eval"`. - 1. Let |isTrusted| be `true`. - 1. If |bodyArg| is not a {{TrustedScript}} object, set |isTrusted| to `false`. - 1. If |isTrusted| is `true` then: - 1. If |bodyString| is not equal to |bodyArg|'s [=TrustedScript/data=], set |isTrusted| to `false`. - 1. If |isTrusted| is `true`, then: - 1. For each |arg| in |parameterArgs|: - 1. Let |index| be the index of |arg| in |parameterArgs|. - 1. If |arg| is not a {{TrustedScript}} object, set |isTrusted| to `false`. - 1. If |isTrusted| is `true`, then: - 1. if |parameterStrings|[|index|] is not equal to |arg|'s [=TrustedScript/data=], set |isTrusted| to `false`. - 1. If |isTrusted| is `true`, let |sourceToValidate| be a new instance of - the {{TrustedScript}} interface, with its [=TrustedScript/data=] - set to |source|. Otherwise, let |sourceToValidate| be |source|. - - 1. Let |sourceString| be the result of executing the - [$Get Trusted Type compliant string$] algorithm, with: - * |calleeRealm| as |global|, - * |sourceToValidate| as |input|, - * |compilationSink| as |sink|, - * `'script'` as |sinkGroup|, - * {{TrustedScript}} as |expectedType|. - - 1. If the algorithm throws an error, throw an {{EvalError}}. - - 1. If |sourceString| is not equal to |source|, throw an {{EvalError}}. - -1. Let |global| be a |calleeRealm|'s [=realm/global object=]. - -1. Let |result| be "`Allowed`". - -1. For each |policy| in |global|'s CSP list: - - 1. Let |source-list| be `null`. - - 2. If |policy| contains a [=directive=] whose [=directive/name=] is "`script-src`", then - set |source-list| to that [=directive=]'s [=directive/value=]. - - Otherwise if |policy| contains a [=directive=] whose [=directive/name=] is - "`default-src`", then set |source-list| to that directive's [=directive/value=]. - - 3. If |source-list| is not `null`, and does not contain a [=source expression=] which is - an [=ASCII case-insensitive=] match for the string "`'unsafe-eval'`" then: - - 1. Let |violation| be the result of executing [[CSP3#create-violation-for-global]] on - |global|, |policy|, and "`script-src`". - - 2. Set |violation|'s [=violation/resource=] to "`inline`". - - 3. If |source-list| [=list/contains=] the expression - "`'report-sample'`", then set |violation|'s [=violation/sample=] to - the substring of |source| |sourceString| containing its first - 40 characters. - - 4. Execute [[CSP3#report-violation]] on |violation|. - - 5. If |policy|'s [=policy/disposition=] is "`enforce`", then set |result| to - "`Blocked`". - -1. If |result| is "`Blocked`", throw an `EvalError` exception. +Note: See [https://github.com/w3c/webappsec-csp/pull/659](https://github.com/w3c/webappsec-csp/pull/659) which upstreams this integration. # Security Considerations # {#security-considerations}