Skip to content

Update references and clarify section 3.5 in the current version of the spec #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Update references and clarify section 3.5 in the current version of the spec #112

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
28ad1fb
Update references and clarify section 3.5 in the current version of t…
baek9 Jan 25, 2022
01a3f02
Remove items related to options from the ABNF syntax
baek9 Jan 26, 2022
f9db377
fix WSP reference
baek9 Jan 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 15 additions & 18 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,8 +247,8 @@ spec: SHA2; urlPrefix: http://csrc.nist.gov/publications/fips/fips180-4/fips-180

This metadata MUST be encoded in the same format as the `hash-source` (without
the single quotes) in <a
href="http://www.w3.org/TR/CSP2/#source-list-syntax">section 4.2 of the Content
Security Policy Level 2 specification</a>.
href="http://www.w3.org/TR/CSP3/#framework-directive-source-list">section
2.3.1 of the Content Security Policy Level 3 specification</a>. [[!CSP3]]

For example, given a script resource containing only the string `alert('Hello,
world.');`, an author might choose <a>SHA-384</a> as a hash function.
Expand Down Expand Up @@ -451,24 +451,21 @@ spec: SHA2; urlPrefix: http://csrc.nist.gov/publications/fips/fips180-4/fips-180
valid metadata as described by the following ABNF grammar:

<pre dfn-type="grammar" link-type="grammar">
<dfn>integrity-metadata</dfn> = *<a>WSP</a> <a>hash-with-options</a> *(1*<a>WSP</a> <a>hash-with-options</a> ) *<a>WSP</a> / *<a>WSP</a>
Copy link
Contributor Author

@baek9 baek9 Jan 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2.2 Grammatical Concepts defines WSP with reference to 2.4.1 Common parser idioms. The link is broken and redirects to https://html.spec.whatwg.org. On the other hand, Terms defined by reference defines WSP and VCHAR with reference to RFC5234:ABNF.

Therefore, in 2.2 Grammatical Concepts, it seems that WSP should be modified to refer to RFC5234:ABNF as well as VCHAR.

<dfn>hash-with-options</dfn> = <a>hash-expression</a> *("?" <a>option-expression</a>)
<dfn>option-expression</dfn> = *<a>VCHAR</a>
<dfn>hash-algo</dfn> = &lt;hash-algo production from [Content Security Policy Level 2, section 4.2]&gt;
<dfn>base64-value</dfn> = &lt;base64-value production from [Content Security Policy Level 2, section 4.2]&gt;
<dfn>integrity-metadata</dfn> = *<a>WSP</a> <a>hash-expression</a> *(1*<a>WSP</a> <a>hash-expression</a> ) *<a>WSP</a> / *<a>WSP</a>
<dfn>hash-algo</dfn> = &lt;hash-algo production from [Content Security Policy Level 3, section 2.3.1]&gt;
<dfn>base64-value</dfn> = &lt;base64-value production from [Content Security Policy Level 3, section 2.3.1]&gt;
<dfn>hash-expression</dfn> = <a>hash-algo</a> "-" <a>base64-value</a>
<dfn>option-expression</dfn> = *<a>VCHAR</a>
<dfn>hash-with-options</dfn> = <a>hash-expression</a> *("?" <a>option-expression</a>)
</pre>

`option-expression`s are associated on a per `hash-expression` basis and are
applied only to the `hash-expression` that immediately precedes it.

In order for user agents to remain fully forwards compatible with future
options, the user agent MUST ignore all unrecognized `option-expression`s.

Note: Note that while the `option-expression` has been reserved in the syntax,
no options have been defined. It is likely that a future version of the spec
will define a more specific syntax for options, so it is defined here as broadly
as possible.

Note: Note that while the `option-expression` and `hash-with-options` have
been reserved in the syntax, no `options` have been defined. It is likely that
a future version of the spec will define a more specific syntax for options,
so it is defined here as broadly as possible. If `options` are to be defined
in a future version, the `option-expression` should be modified accordingly.
Also, all `hash-expression`s of the 'integrity-metadata' should be replaced
with `hash-with-options`.

## Handling integrity violations ## {#handling-integrity-violations}

Expand Down