From ed892885a0d329406398db8d5288b90e927c23b8 Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Tue, 8 Apr 2025 05:31:47 -0700 Subject: [PATCH 01/19] Integrity Policy header --- index.bs | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/index.bs b/index.bs index 1502f61..d54227a 100644 --- a/index.bs +++ b/index.bs @@ -44,9 +44,17 @@ spec: SHA2; urlPrefix: https://csrc.nist.gov/publications/fips/fips180-4/fips-18 text: SHA-256; url: # text: SHA-384; url: # text: SHA-512; url: # + spec: RFC8288; urlPrefix: https://tools.ietf.org/html/rfc8288 type: http-header text: link + +spec RFC9651; urlPrefix: https://tools.ietf.org/html/rfc9651 + type: dfn + text: Dictionary; url: name-dictionaries + text: inner list; url: name-inner-lists + text: token; url: name-tokens + 
 spec:csp3; type:grammar; text:base64-value
@@ -485,6 +493,15 @@ spec:csp3; type:grammar; text:base64-value
   failed resource with a different one.
 
   
+  
+  ## Integrity-Policy ## {#integrity-policy}
+  The `Integrity-Policy` HTTP header enables a document to enforce a policy regarding
+  the integrity metadata requirements on all the subresources it loads of certain
+  destinations.
+
+  It is a Dictionary [[RFC9651]], with every member-value being an
+  inner list of tokens.
+  
 
   # Proxies # {#proxies}
 

From d7ed19e6541a4b0b3682ac9280075ff13f050714 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Tue, 15 Apr 2025 14:46:56 +0200
Subject: [PATCH 02/19] Got a rough outline

---
 index.bs | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 59 insertions(+), 5 deletions(-)

diff --git a/index.bs b/index.bs
index d54227a..2fd8c1a 100644
--- a/index.bs
+++ b/index.bs
@@ -49,7 +49,7 @@ spec: RFC8288; urlPrefix: https://tools.ietf.org/html/rfc8288
   type: http-header
     text: link
 
-spec RFC9651; urlPrefix: https://tools.ietf.org/html/rfc9651
+spec: RFC9651; urlPrefix: https://tools.ietf.org/html/rfc9651
   type: dfn
     text: Dictionary; url: name-dictionaries
     text: inner list; url: name-inner-lists
@@ -495,13 +495,67 @@ spec:csp3; type:grammar; text:base64-value
   
   
   ## Integrity-Policy ## {#integrity-policy}
-  The `Integrity-Policy` HTTP header enables a document to enforce a policy regarding
-  the integrity metadata requirements on all the subresources it loads of certain
-  destinations.
+  The `Integrity-Policy` and `Integrity-Policy-Report-Only` HTTP headers enable a document to
+  enforce a policy regarding the integrity metadata requirements on all the subresources it
+  loads of certain destinations.
 
-  It is a Dictionary [[RFC9651]], with every member-value being an
+  The headers' value is a Dictionary [[RFC9651]], with every member-value being an
   inner list of tokens.
   
+  An integrity policy struct, is a struct that contains the following:
+    * enforcement, a string which is the empty string or "block". Initially "block".
+    * source, a string which is the empty string or "inline". Initially "inline".
+    * destination, a string which is the empty string or "script". Initially the empty string.
+    * endpoints, a list of strings, initially empty.
+
+  When processing an integrity policy, with |value|, do the following:
+  1) Let |integrity policy| be a new integrity policy struct.
+  1) Let dictionary be the result of parsing a dictionary with |input|.
+  1) If dictionary['enforcement'] exists:
+    1) If its value is "block", set |integrity policy|'s |enforcement| to "block".
+    1) Otherwise, set |integrity policy|'s |enforcement| to the empty string.
+  1) If dictionary['sources'] exists:
+    1) If its value contains "inline", set |integrity policy|'s |source| to "inline".
+    1) Otherwise, set |integrity policy|'s |source| to the empty string.
+  1) If dictionary['destinations'] exists:
+    1) If its value contains "script", set |integrity policy|'s |destination| to "script".
+  1) if dictionary['endpoints'] exists:
+    1) Set |integrity policy|'s |endpoints| to dictionary['endpoints'].
+  1) return |integrity policy|
+  
+  Each Document has an integrity policy, an integrity policy struct.
+  Each Document has an integrity policy report only, an integrity policy struct.
+
+  ### Parse Integrity-Policy headers
+  Given a response |response| and a Document |document|, do the following:
+  1) Let |headers| be |response|'s header list.
+  1) If |headers| contains a header whose header name is "Integrity-Policy",
+     let |document|'s integrity policy be the result of running processing an integrity policy
+     with the corresponding header value.
+  1) If |headers| contains a header whose header name is "Integrity-Policy-Report-Only",
+     let |document|'s integrity policy report only be the result of running processing an integrity
+     policy with the corresponding header value.
+  
+  ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy}
+  Given a request |request| and a Document |document|, do the following:
+  1) if |request|'s integrity metadata is not empty, return false.
+  1) Let |policy| be |document|'s integrity policy.
+  1) Let |report policy| be |document|'s integrity policy report only.
+  1) Let |block| be a boolean, initially false.
+  1) Let |report block| be a boolean, initially false.
+  1) if |policy|'s enforcement is "block" and |policy|'s source is "inline" and |policy|'s
+     destination is equal to |request|'s destination, set |block| to true.
+  1) if |report policy|'s enforcement is "block" and |report policy|'s source is "inline"
+     and |report policy|'s destination is equal to |request|'s destination, set
+    |report block| to true.
+  1) If |block| or |report block|, fire a violation event.
+  1) If |block|, report violation with |policy|'s endpoints.
+  1) If |report block|, report violation with |report policy|'s endpoints.
+ 
+  ### Fire a violation event ### {#fire-violation-event}
+  ### Report violatoin ### {#report-violation}
+
+  ### Fetch integration ### {#fetch-integration}
 
   # Proxies # {#proxies}
 

From 4284d8908b381ae955362426e75a8999b058baf5 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Tue, 15 Apr 2025 15:43:42 +0200
Subject: [PATCH 03/19] Got most of it

---
 index.bs | 87 ++++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 60 insertions(+), 27 deletions(-)

diff --git a/index.bs b/index.bs
index 2fd8c1a..94b9354 100644
--- a/index.bs
+++ b/index.bs
@@ -32,6 +32,22 @@ spec: ABNF; urlPrefix: https://tools.ietf.org/html/rfc5234
     text: VCHAR; url: appendix-B.1
     text: WSP; url: appendix-B.1
 
+spec: INFRA; urlPrefix: https://infra.spec.whatwg.org
+  type: dfn
+    text: list; url: list
+
+spec: HTML; urlPrefix: https://html.spec.whatwg.org/C
+  type: dfn
+    text: policy container; url: policy-container
+
+spec: FETCH; urlPrefix: https://fetch.spec.whatwg.org/
+  type: dfn
+    text: request; url: concept-request 
+    text: response; url: concept-response 
+    text: header list; url: concept-response-header-list
+    text: header; url: concept-header
+    text: main fetch; url: main-fetch
+
 spec: RFC7234; urlPrefix: https://tools.ietf.org/html/rfc7234
   type: dfn
     text: Cache-Control; url: section-5.2
@@ -54,6 +70,7 @@ spec: RFC9651; urlPrefix: https://tools.ietf.org/html/rfc9651
     text: Dictionary; url: name-dictionaries
     text: inner list; url: name-inner-lists
     text: token; url: name-tokens
+    text: parsing a dictionary; url: name-parsing-a-dictionary
 
 
@@ -494,7 +511,7 @@ spec:csp3; type:grammar; text:base64-value
 
   
   
-  ## Integrity-Policy ## {#integrity-policy}
+  ## Integrity-Policy ## {#integrity-policy-section}
   The `Integrity-Policy` and `Integrity-Policy-Report-Only` HTTP headers enable a document to
   enforce a policy regarding the integrity metadata requirements on all the subresources it
   loads of certain destinations.
@@ -508,39 +525,39 @@ spec:csp3; type:grammar; text:base64-value
     * destination, a string which is the empty string or "script". Initially the empty string.
     * endpoints, a list of strings, initially empty.
 
-  When processing an integrity policy, with |value|, do the following:
+  When processing an integrity policy, with |input|, do the following:
   1) Let |integrity policy| be a new integrity policy struct.
-  1) Let dictionary be the result of parsing a dictionary with |input|.
-  1) If dictionary['enforcement'] exists:
-    1) If its value is "block", set |integrity policy|'s |enforcement| to "block".
-    1) Otherwise, set |integrity policy|'s |enforcement| to the empty string.
-  1) If dictionary['sources'] exists:
-    1) If its value contains "inline", set |integrity policy|'s |source| to "inline".
-    1) Otherwise, set |integrity policy|'s |source| to the empty string.
-  1) If dictionary['destinations'] exists:
-    1) If its value contains "script", set |integrity policy|'s |destination| to "script".
-  1) if dictionary['endpoints'] exists:
-    1) Set |integrity policy|'s |endpoints| to dictionary['endpoints'].
+  1) Let |dictionary| be the result of parsing a dictionary with |input|.
+  1) If |dictionary|['enforcement'] exists:
+    1) If its value is "block", set |integrity policy|'s enforcement to "block".
+    1) Otherwise, set |integrity policy|'s enforcement to the empty string.
+  1) If |dictionary|['sources'] exists:
+    1) If its value contains "inline", set |integrity policy|'s source to "inline".
+    1) Otherwise, set |integrity policy|'s source to the empty string.
+  1) If |dictionary|['destinations'] exists:
+    1) If its value contains "script", set |integrity policy|'s destination to "script".
+  1) if |dictionary|['endpoints'] exists:
+    1) Set |integrity policy|'s endpoints to |dictionary|['endpoints'].
   1) return |integrity policy|
   
-  Each Document has an integrity policy, an integrity policy struct.
-  Each Document has an integrity policy report only, an integrity policy struct.
-
-  ### Parse Integrity-Policy headers
-  Given a response |response| and a Document |document|, do the following:
+  ### Parse Integrity-Policy headers ### {#parse-integrity-policy-headers-section}
+  To parse Integrity-Policy headers, given a Response |response|
+  and a policy container |container|, do the following:
   1) Let |headers| be |response|'s header list.
   1) If |headers| contains a header whose header name is "Integrity-Policy",
-     let |document|'s integrity policy be the result of running processing an integrity policy
+     let |container|'s integrity policy be the result of running processing an integrity policy
      with the corresponding header value.
   1) If |headers| contains a header whose header name is "Integrity-Policy-Report-Only",
-     let |document|'s integrity policy report only be the result of running processing an integrity
+     let |container|'s report only integrity policy be the result of running processing an integrity
      policy with the corresponding header value.
   
-  ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy}
-  Given a request |request| and a Document |document|, do the following:
-  1) if |request|'s integrity metadata is not empty, return false.
-  1) Let |policy| be |document|'s integrity policy.
-  1) Let |report policy| be |document|'s integrity policy report only.
+  ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy-section}
+  To determine should request be blocked by integrity policy, given a request |request|,
+  do the following:
+  1) Let |policy container| be |request|'s policy container.
+  1) if |request|'s integrity metadata is not empty, return "Allowed".
+  1) Let |policy| be |policy container|'s integrity policy.
+  1) Let |report policy| be |policy container|'s report only integrity policy.
   1) Let |block| be a boolean, initially false.
   1) Let |report block| be a boolean, initially false.
   1) if |policy|'s enforcement is "block" and |policy|'s source is "inline" and |policy|'s
@@ -551,11 +568,27 @@ spec:csp3; type:grammar; text:base64-value
   1) If |block| or |report block|, fire a violation event.
   1) If |block|, report violation with |policy|'s endpoints.
   1) If |report block|, report violation with |report policy|'s endpoints.
+  1) If |block|, return "Blocked". Otherwise, return "Allowed".
  
   ### Fire a violation event ### {#fire-violation-event}
-  ### Report violatoin ### {#report-violation}
+  To fire a violation event, do the following:
+  1) TODO
+
+  ### Report violation ### {#report-violation-section}
+  To report violation given a list |endpoints|, do the following:
+  1) TODO do something with |endpoints|
+
+  ### Integration ### {#integration}
+
+  A policy container has extra items:
+  * integrity policy, an integrity policy struct.
+  * report only integrity policy, an integrity policy struct.
+
+  Add an extra step to create a policy container from a fetch response before it returns, that runs
+  parse Integrity-Policy headers with response and result.
 
-  ### Fetch integration ### {#fetch-integration}
+  Expand step 7 of main fetch to call should request be blocked by integrity policy
+  and return a network error if it returns "blocked"
 
   # Proxies # {#proxies}
 

From dc5175162f79452d60c31cf92bc849a9b93e8cde Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Wed, 16 Apr 2025 11:07:32 +0200
Subject: [PATCH 04/19] Review comments

---
 index.bs | 73 +++++++++++++++++++++++++++++++-------------------------
 1 file changed, 41 insertions(+), 32 deletions(-)

diff --git a/index.bs b/index.bs
index 94b9354..38688fc 100644
--- a/index.bs
+++ b/index.bs
@@ -519,68 +519,77 @@ spec:csp3; type:grammar; text:base64-value
   The headers' value is a Dictionary [[RFC9651]], with every member-value being an
   inner list of tokens.
   
+  A source is a string. The only possible value for it is "inline".
+  A destination is a string. The only possible value for it is "script".
+
   An integrity policy struct, is a struct that contains the following:
+
     * enforcement, a string which is the empty string or "block". Initially "block".
-    * source, a string which is the empty string or "inline". Initially "inline".
-    * destination, a string which is the empty string or "script". Initially the empty string.
+    * sources, a list of sources, Initially empty.
+    * destinations, a list of destinations, Initially empty.
     * endpoints, a list of strings, initially empty.
 
   When processing an integrity policy, with |input|, do the following:
-  1) Let |integrity policy| be a new integrity policy struct.
-  1) Let |dictionary| be the result of parsing a dictionary with |input|.
-  1) If |dictionary|['enforcement'] exists:
-    1) If its value is "block", set |integrity policy|'s enforcement to "block".
-    1) Otherwise, set |integrity policy|'s enforcement to the empty string.
-  1) If |dictionary|['sources'] exists:
-    1) If its value contains "inline", set |integrity policy|'s source to "inline".
-    1) Otherwise, set |integrity policy|'s source to the empty string.
-  1) If |dictionary|['destinations'] exists:
-    1) If its value contains "script", set |integrity policy|'s destination to "script".
-  1) if |dictionary|['endpoints'] exists:
-    1) Set |integrity policy|'s endpoints to |dictionary|['endpoints'].
-  1) return |integrity policy|
+
+  1. Let |integrity policy| be a new integrity policy struct.
+  1. Let |dictionary| be the result of parsing a dictionary with |input|.
+  1. If |dictionary|['enforcement'] exists:
+    1. If its value is "block", set |integrity policy|'s enforcement to "block".
+    1. Otherwise, set |integrity policy|'s enforcement to the empty string.
+  1. If |dictionary|['sources'] does not exist or if its value does not contain "inline",
+     append "inline" to |integrity policy|'s sources.
+  1. If |dictionary|['destinations'] exists:
+    1. If its value contains "script", set |integrity policy|'s destinations to "script".
+  1. if |dictionary|['endpoints'] exists:
+    1. Set |integrity policy|'s endpoints to |dictionary|['endpoints'].
+  1. return |integrity policy|
   
   ### Parse Integrity-Policy headers ### {#parse-integrity-policy-headers-section}
   To parse Integrity-Policy headers, given a Response |response|
   and a policy container |container|, do the following:
-  1) Let |headers| be |response|'s header list.
-  1) If |headers| contains a header whose header name is "Integrity-Policy",
+
+  1. Let |headers| be |response|'s header list.
+  1. If |headers| contains a header whose header name is "Integrity-Policy",
      let |container|'s integrity policy be the result of running processing an integrity policy
      with the corresponding header value.
-  1) If |headers| contains a header whose header name is "Integrity-Policy-Report-Only",
+  1. If |headers| contains a header whose header name is "Integrity-Policy-Report-Only",
      let |container|'s report only integrity policy be the result of running processing an integrity
      policy with the corresponding header value.
   
   ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy-section}
   To determine should request be blocked by integrity policy, given a request |request|,
   do the following:
-  1) Let |policy container| be |request|'s policy container.
-  1) if |request|'s integrity metadata is not empty, return "Allowed".
-  1) Let |policy| be |policy container|'s integrity policy.
-  1) Let |report policy| be |policy container|'s report only integrity policy.
-  1) Let |block| be a boolean, initially false.
-  1) Let |report block| be a boolean, initially false.
-  1) if |policy|'s enforcement is "block" and |policy|'s source is "inline" and |policy|'s
+
+  1. Let |policy container| be |request|'s policy container.
+  1. if |request|'s integrity metadata is not empty, return "Allowed".
+  1. Let |policy| be |policy container|'s integrity policy.
+  1. Let |report policy| be |policy container|'s report only integrity policy.
+  1. Let |block| be a boolean, initially false.
+  1. Let |report block| be a boolean, initially false.
+  1. if |policy|'s enforcement is "block" and |policy|'s source is "inline" and |policy|'s
      destination is equal to |request|'s destination, set |block| to true.
-  1) if |report policy|'s enforcement is "block" and |report policy|'s source is "inline"
+  1. if |report policy|'s enforcement is "block" and |report policy|'s source is "inline"
      and |report policy|'s destination is equal to |request|'s destination, set
     |report block| to true.
-  1) If |block| or |report block|, fire a violation event.
-  1) If |block|, report violation with |policy|'s endpoints.
-  1) If |report block|, report violation with |report policy|'s endpoints.
-  1) If |block|, return "Blocked". Otherwise, return "Allowed".
+  1. If |block| or |report block|, fire a violation event.
+  1. If |block|, report violation with |policy|'s endpoints.
+  1. If |report block|, report violation with |report policy|'s endpoints.
+  1. If |block|, return "Blocked". Otherwise, return "Allowed".
  
   ### Fire a violation event ### {#fire-violation-event}
   To fire a violation event, do the following:
-  1) TODO
+
+  1. TODO
 
   ### Report violation ### {#report-violation-section}
   To report violation given a list |endpoints|, do the following:
-  1) TODO do something with |endpoints|
+
+  1. TODO do something with |endpoints|
 
   ### Integration ### {#integration}
 
   A policy container has extra items:
+
   * integrity policy, an integrity policy struct.
   * report only integrity policy, an integrity policy struct.
 

From bea33f05284008de6427d64d9372c9511676470b Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Wed, 16 Apr 2025 12:37:33 +0200
Subject: [PATCH 05/19] Fire an event

---
 index.bs | 38 +++++++++++++++++++++++++++++++++++---
 1 file changed, 35 insertions(+), 3 deletions(-)

diff --git a/index.bs b/index.bs
index 38688fc..25ba4bf 100644
--- a/index.bs
+++ b/index.bs
@@ -32,6 +32,14 @@ spec: ABNF; urlPrefix: https://tools.ietf.org/html/rfc5234
     text: VCHAR; url: appendix-B.1
     text: WSP; url: appendix-B.1
 
+spec: CSP; urlPrefix: https://www.w3.org/TR/CSP3/
+  type: dfn
+    text: strip url for use in reports; url: strip-url-for-use-in-reports
+
+spec: DOM; urlPrefix: https://dom.spec.whatwg.org/
+  type: dfn
+    text: document url; url: concept-document-url
+
 spec: INFRA; urlPrefix: https://infra.spec.whatwg.org
   type: dfn
     text: list; url: list
@@ -39,6 +47,8 @@ spec: INFRA; urlPrefix: https://infra.spec.whatwg.org
 spec: HTML; urlPrefix: https://html.spec.whatwg.org/C
   type: dfn
     text: policy container; url: policy-container
+    text: global object; url: global-object
+    text: window; url: window
 
 spec: FETCH; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
@@ -571,15 +581,37 @@ spec:csp3; type:grammar; text:base64-value
   1. if |report policy|'s enforcement is "block" and |report policy|'s source is "inline"
      and |report policy|'s destination is equal to |request|'s destination, set
     |report block| to true.
-  1. If |block| or |report block|, fire a violation event.
+  1. If |block| or |report block|, fire a violation event with |request|.
   1. If |block|, report violation with |policy|'s endpoints.
   1. If |report block|, report violation with |report policy|'s endpoints.
   1. If |block|, return "Blocked". Otherwise, return "Allowed".
  
   ### Fire a violation event ### {#fire-violation-event}
-  To fire a violation event, do the following:
 
-  1. TODO
+  
+
+    [Exposed=(Window,Worker)]
+    interface IntegrityPolicyViolationEvent : Event {
+        constructor(DOMString type, optional IntegrityPolicyViolationEventInit eventInitDict = {});
+        readonly    attribute USVString      documentURI;
+        readonly    attribute USVString      blockedURI;
+    };
+    dictionary IntegrityPolicyViolationEventInit : EventInit {
+        USVString      documentURI = "";
+        USVString      blockedURI = "";
+    };
+  

+
+  To fire a violation event given a Request |request|, do the following:
+
+  1. Assert that |request|'s client is not null.
+  1. Let |global| be |request|'s client's global object.
+  1. Assert that |global| is a Window.
+  1. Let |target| be |global|'s associated Document.
+  1. Let |documentURI| be the result of strip URL for use in reports on |target|'s document URL.
+  1. Let |blockedURI| be the result of strip URL for use in reports on |request|'s URL.
+  1. Fire an event names "integritypolicyviolation" that uses the `IntegrityPolicyViolationEvent`
+     interface at |target|, with its attributes initiaized to |documentURI| and |blockedURI|.
 
   ### Report violation ### {#report-violation-section}
   To report violation given a list |endpoints|, do the following:

From 0bf7b1e9c4cc417a11e949d6eea5505fd467f368 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Wed, 16 Apr 2025 13:19:32 +0200
Subject: [PATCH 06/19] Send reports

---
 index.bs | 71 ++++++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 53 insertions(+), 18 deletions(-)

diff --git a/index.bs b/index.bs
index 25ba4bf..39eb054 100644
--- a/index.bs
+++ b/index.bs
@@ -581,42 +581,77 @@ spec:csp3; type:grammar; text:base64-value
   1. if |report policy|'s enforcement is "block" and |report policy|'s source is "inline"
      and |report policy|'s destination is equal to |request|'s destination, set
     |report block| to true.
-  1. If |block| or |report block|, fire a violation event with |request|.
-  1. If |block|, report violation with |policy|'s endpoints.
-  1. If |report block|, report violation with |report policy|'s endpoints.
+  1. If |block| or |report block|, report violation with |request|, |block|, |report block|,
+     |policy| and |report policy|.
   1. If |block|, return "Blocked". Otherwise, return "Allowed".
  
-  ### Fire a violation event ### {#fire-violation-event}
+  ### Report violations ### {#report-violations}
 
   
 
     [Exposed=(Window,Worker)]
     interface IntegrityPolicyViolationEvent : Event {
         constructor(DOMString type, optional IntegrityPolicyViolationEventInit eventInitDict = {});
-        readonly    attribute USVString      documentURI;
-        readonly    attribute USVString      blockedURI;
+        readonly    attribute USVString      documentURL;
+        readonly    attribute USVString      blockedURL;
     };
     dictionary IntegrityPolicyViolationEventInit : EventInit {
-        USVString      documentURI = "";
-        USVString      blockedURI = "";
+        USVString      documentURL = "";
+        USVString      blockedURL = "";
     };
   

 
-  To fire a violation event given a Request |request|, do the following:
+  
+    [Exposed=Window]
+    interface IntegrityPolicyViolationReportBody : ReportBody {
+      [Default] object toJSON();
+      readonly attribute USVString documentURL;
+      readonly attribute USVString? blockedURL;
+    };
+  

+
+  To report violation given a Request |request|, a boolean |block|,
+  a boolean |report block|, an integrity policy struct |policy|,
+  and an integrity policy struct |report policy|, do the following:
 
   1. Assert that |request|'s client is not null.
-  1. Let |global| be |request|'s client's global object.
+  1. Let |settings object| be |request|'s client.
+  1. Let |global| be |settings object|'s global object.
   1. Assert that |global| is a Window.
   1. Let |target| be |global|'s associated Document.
-  1. Let |documentURI| be the result of strip URL for use in reports on |target|'s document URL.
-  1. Let |blockedURI| be the result of strip URL for use in reports on |request|'s URL.
+  1. Let |document URL| be the result of strip URL for use in reports on |target|'s document URL.
+  1. Let |blocked URL| be the result of strip URL for use in reports on |request|'s URL.
   1. Fire an event names "integritypolicyviolation" that uses the `IntegrityPolicyViolationEvent`
-     interface at |target|, with its attributes initiaized to |documentURI| and |blockedURI|.
-
-  ### Report violation ### {#report-violation-section}
-  To report violation given a list |endpoints|, do the following:
-
-  1. TODO do something with |endpoints|
+     interface at |target|, with its attributes initiaized as follows:
+              :   {{IntegrityPolicyViolationEvent/documentURL}}
+              ::  |document URL|
+              :   {{IntegrityPolicyViolationEvent/blockedURL}}
+              ::  |blocked URL|
+  1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows:
+              :   {{IntegrityPolicyViolationReportBody/documentURL}}
+              ::  |document URL|
+              :   {{IntegrityPolicyViolationReportBody/blockedURL}}
+              ::  |blocked URL|
+  1. If |block|, for each |endpoint| in |policy|'s endpoints,
+     generate and queue a report with the following arguments:
+              :   context
+              ::  |settings object|
+              :   type
+              ::  "integrity-policy-violation"
+              :   destination
+              ::  |endpoint|
+              :   data
+              ::  |body|
+  1. If |report block|, for each |endpoint| in |report policy|'s endpoints,
+     generate and queue a report with the following arguments:
+              :   context
+              ::  |settings object|
+              :   type
+              ::  "integrity-policy-violation"
+              :   destination
+              ::  |endpoint|
+              :   data
+              ::  |body|
 
   ### Integration ### {#integration}
 

From bea36d09ad218f41182574940df834c097d01269 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Fri, 18 Apr 2025 05:35:24 +0200
Subject: [PATCH 07/19] Remove event, add destination and correct algo

---
 index.bs | 59 ++++++++++++++++++++++++++------------------------------
 1 file changed, 27 insertions(+), 32 deletions(-)

diff --git a/index.bs b/index.bs
index 39eb054..dcb8717 100644
--- a/index.bs
+++ b/index.bs
@@ -546,7 +546,7 @@ spec:csp3; type:grammar; text:base64-value
   1. If |dictionary|['enforcement'] exists:
     1. If its value is "block", set |integrity policy|'s enforcement to "block".
     1. Otherwise, set |integrity policy|'s enforcement to the empty string.
-  1. If |dictionary|['sources'] does not exist or if its value does not contain "inline",
+  1. If |dictionary|['sources'] does not exist or if its value contains "inline",
      append "inline" to |integrity policy|'s sources.
   1. If |dictionary|['destinations'] exists:
     1. If its value contains "script", set |integrity policy|'s destinations to "script".
@@ -587,26 +587,14 @@ spec:csp3; type:grammar; text:base64-value
  
   ### Report violations ### {#report-violations}
 
-  
-
-    [Exposed=(Window,Worker)]
-    interface IntegrityPolicyViolationEvent : Event {
-        constructor(DOMString type, optional IntegrityPolicyViolationEventInit eventInitDict = {});
-        readonly    attribute USVString      documentURL;
-        readonly    attribute USVString      blockedURL;
-    };
-    dictionary IntegrityPolicyViolationEventInit : EventInit {
-        USVString      documentURL = "";
-        USVString      blockedURL = "";
-    };
-  

-
   
     [Exposed=Window]
     interface IntegrityPolicyViolationReportBody : ReportBody {
       [Default] object toJSON();
       readonly attribute USVString documentURL;
-      readonly attribute USVString? blockedURL;
+      readonly attribute USVString blockedURL;
+      readonly attribute USVString destination;
+      readonly attribute boolean   reportOnly;
     };
   

 
@@ -621,19 +609,17 @@ spec:csp3; type:grammar; text:base64-value
   1. Let |target| be |global|'s associated Document.
   1. Let |document URL| be the result of strip URL for use in reports on |target|'s document URL.
   1. Let |blocked URL| be the result of strip URL for use in reports on |request|'s URL.
-  1. Fire an event names "integritypolicyviolation" that uses the `IntegrityPolicyViolationEvent`
-     interface at |target|, with its attributes initiaized as follows:
-              :   {{IntegrityPolicyViolationEvent/documentURL}}
-              ::  |document URL|
-              :   {{IntegrityPolicyViolationEvent/blockedURL}}
-              ::  |blocked URL|
-  1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows:
-              :   {{IntegrityPolicyViolationReportBody/documentURL}}
-              ::  |document URL|
-              :   {{IntegrityPolicyViolationReportBody/blockedURL}}
-              ::  |blocked URL|
-  1. If |block|, for each |endpoint| in |policy|'s endpoints,
-     generate and queue a report with the following arguments:
+  1. If |block|, for each |endpoint| in |policy|'s endpoints:
+     1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows:
+                 :   {{IntegrityPolicyViolationReportBody/documentURL}}
+                 ::  |document URL|
+                 :   {{IntegrityPolicyViolationReportBody/blockedURL}}
+                 ::  |blocked URL|
+                 :   {{IntegrityPolicyViolationReportBody/destination}}
+                 ::  |request|'s destination
+                 :   {{IntegrityPolicyViolationReportBody/reportOnly}}
+                 ::  false
+     2. Generate and queue a report with the following arguments:
               :   context
               ::  |settings object|
               :   type
@@ -642,8 +628,17 @@ spec:csp3; type:grammar; text:base64-value
               ::  |endpoint|
               :   data
               ::  |body|
-  1. If |report block|, for each |endpoint| in |report policy|'s endpoints,
-     generate and queue a report with the following arguments:
+  1. If |report block|, for each |endpoint| in |policy|'s endpoints:
+     1. Let |report body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows:
+                 :   {{IntegrityPolicyViolationReportBody/documentURL}}
+                 ::  |document URL|
+                 :   {{IntegrityPolicyViolationReportBody/blockedURL}}
+                 ::  |blocked URL|
+                 :   {{IntegrityPolicyViolationReportBody/destination}}
+                 ::  |request|'s destination
+                 :   {{IntegrityPolicyViolationReportBody/reportOnly}}
+                 ::  true 
+     2. Generate and queue a report with the following arguments:
               :   context
               ::  |settings object|
               :   type
@@ -651,7 +646,7 @@ spec:csp3; type:grammar; text:base64-value
               :   destination
               ::  |endpoint|
               :   data
-              ::  |body|
+              ::  |report body|
 
   ### Integration ### {#integration}
 

From fdd459ae86cd39c9aad8cd620d63216a8d3e63af Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Fri, 18 Apr 2025 05:56:54 +0200
Subject: [PATCH 08/19] Add request mode conditions

---
 index.bs | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/index.bs b/index.bs
index dcb8717..e6fb647 100644
--- a/index.bs
+++ b/index.bs
@@ -571,16 +571,21 @@ spec:csp3; type:grammar; text:base64-value
   do the following:
 
   1. Let |policy container| be |request|'s policy container.
-  1. if |request|'s integrity metadata is not empty, return "Allowed".
+  1. if |request|'s integrity metadata is not the empty string
+     and |request|'s mode is either "cors" or "same-origin",
+     return "Allowed".
   1. Let |policy| be |policy container|'s integrity policy.
   1. Let |report policy| be |policy container|'s report only integrity policy.
   1. Let |block| be a boolean, initially false.
   1. Let |report block| be a boolean, initially false.
-  1. if |policy|'s enforcement is "block" and |policy|'s source is "inline" and |policy|'s
-     destination is equal to |request|'s destination, set |block| to true.
-  1. if |report policy|'s enforcement is "block" and |report policy|'s source is "inline"
-     and |report policy|'s destination is equal to |request|'s destination, set
-    |report block| to true.
+  1. if |policy|'s enforcement is "block"
+     and |policy|'s source is "inline"
+     and |policy|'s destination is equal to |request|'s destination,
+     set |block| to true.
+  1. if |report policy|'s enforcement is "block"
+     and |report policy|'s source is "inline"
+     and |report policy|'s destination is equal to |request|'s destination,
+     set |report block| to true.
   1. If |block| or |report block|, report violation with |request|, |block|, |report block|,
      |policy| and |report policy|.
   1. If |block|, return "Blocked". Otherwise, return "Allowed".

From baf426f7d0b667c006ea95b869ce43cf7c558671 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Mon, 21 Apr 2025 11:34:40 +0200
Subject: [PATCH 09/19] Remove enforcement

---
 index.bs | 23 +++++++++--------------
 1 file changed, 9 insertions(+), 14 deletions(-)

diff --git a/index.bs b/index.bs
index e6fb647..95bb313 100644
--- a/index.bs
+++ b/index.bs
@@ -524,7 +524,7 @@ spec:csp3; type:grammar; text:base64-value
   ## Integrity-Policy ## {#integrity-policy-section}
   The `Integrity-Policy` and `Integrity-Policy-Report-Only` HTTP headers enable a document to
   enforce a policy regarding the integrity metadata requirements on all the subresources it
-  loads of certain destinations.
+  loads of certain destinations.
 
   The headers' value is a Dictionary [[RFC9651]], with every member-value being an
   inner list of tokens.
@@ -534,22 +534,19 @@ spec:csp3; type:grammar; text:base64-value
 
   An integrity policy struct, is a struct that contains the following:
 
-    * enforcement, a string which is the empty string or "block". Initially "block".
     * sources, a list of sources, Initially empty.
-    * destinations, a list of destinations, Initially empty.
+    * blocked destinations, a list of destinations, Initially empty.
     * endpoints, a list of strings, initially empty.
 
   When processing an integrity policy, with |input|, do the following:
 
   1. Let |integrity policy| be a new integrity policy struct.
   1. Let |dictionary| be the result of parsing a dictionary with |input|.
-  1. If |dictionary|['enforcement'] exists:
-    1. If its value is "block", set |integrity policy|'s enforcement to "block".
-    1. Otherwise, set |integrity policy|'s enforcement to the empty string.
   1. If |dictionary|['sources'] does not exist or if its value contains "inline",
      append "inline" to |integrity policy|'s sources.
-  1. If |dictionary|['destinations'] exists:
-    1. If its value contains "script", set |integrity policy|'s destinations to "script".
+  1. If |dictionary|['blocked-destinations'] exists:
+    1. If its value contains "script",
+       append "script" to |integrity policy|'s blocked destinations.
   1. if |dictionary|['endpoints'] exists:
     1. Set |integrity policy|'s endpoints to |dictionary|['endpoints'].
   1. return |integrity policy|
@@ -578,13 +575,11 @@ spec:csp3; type:grammar; text:base64-value
   1. Let |report policy| be |policy container|'s report only integrity policy.
   1. Let |block| be a boolean, initially false.
   1. Let |report block| be a boolean, initially false.
-  1. if |policy|'s enforcement is "block"
-     and |policy|'s source is "inline"
-     and |policy|'s destination is equal to |request|'s destination,
+  1. if |policy|'s source is "inline"
+     and |policy|'s blocked destinations contains |request|'s destination,
      set |block| to true.
-  1. if |report policy|'s enforcement is "block"
-     and |report policy|'s source is "inline"
-     and |report policy|'s destination is equal to |request|'s destination,
+  1. if |report policy|'s source is "inline"
+     and |report policy|'s blocked destinations contains |request|'s destination,
      set |report block| to true.
   1. If |block| or |report block|, report violation with |request|, |block|, |report block|,
      |policy| and |report policy|.

From 0d5d643a9d78c0a3523478408657d32bc97f4f71 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Mon, 21 Apr 2025 11:45:08 +0200
Subject: [PATCH 10/19] Fix up sources ref

---
 index.bs | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/index.bs b/index.bs
index 95bb313..e23a485 100644
--- a/index.bs
+++ b/index.bs
@@ -556,12 +556,14 @@ spec:csp3; type:grammar; text:base64-value
   and a policy container |container|, do the following:
 
   1. Let |headers| be |response|'s header list.
-  1. If |headers| contains a header whose header name is "Integrity-Policy",
-     let |container|'s integrity policy be the result of running processing an integrity policy
-     with the corresponding header value.
-  1. If |headers| contains a header whose header name is "Integrity-Policy-Report-Only",
-     let |container|'s report only integrity policy be the result of running processing an integrity
-     policy with the corresponding header value.
+  1. If |headers| contains a header
+     whose header name is "Integrity-Policy",
+     let |container|'s integrity policy be the result of running
+     processing an integrity policy with the corresponding header value.
+  1. If |headers| contains a header
+     whose header name is "Integrity-Policy-Report-Only",
+     let |container|'s report only integrity policy be the result of running
+     processing an integrity policy with the corresponding header value.
   
   ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy-section}
   To determine should request be blocked by integrity policy, given a request |request|,
@@ -575,11 +577,13 @@ spec:csp3; type:grammar; text:base64-value
   1. Let |report policy| be |policy container|'s report only integrity policy.
   1. Let |block| be a boolean, initially false.
   1. Let |report block| be a boolean, initially false.
-  1. if |policy|'s source is "inline"
-     and |policy|'s blocked destinations contains |request|'s destination,
+  1. if |policy|'s sources contains "inline"
+     and |policy|'s blocked destinations contains
+     |request|'s destination,
      set |block| to true.
-  1. if |report policy|'s source is "inline"
-     and |report policy|'s blocked destinations contains |request|'s destination,
+  1. if |policy|'s sources contains "inline"
+     and |report policy|'s blocked destinations contains
+     |request|'s destination,
      set |report block| to true.
   1. If |block| or |report block|, report violation with |request|, |block|, |report block|,
      |policy| and |report policy|.

From 5229ce5658947147aab683ce506502e8943ed894 Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Tue, 29 Apr 2025 18:14:08 +0200
Subject: [PATCH 11/19] Clarify that we are only dealing with Window for now

---
 index.bs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/index.bs b/index.bs
index e23a485..d51c7fe 100644
--- a/index.bs
+++ b/index.bs
@@ -575,6 +575,8 @@ spec:csp3; type:grammar; text:base64-value
      return "Allowed".
   1. Let |policy| be |policy container|'s integrity policy.
   1. Let |report policy| be |policy container|'s report only integrity policy.
+  1. If both |policy| and |report policy| are empty integrity policy structs, return "Allowed".
+  1. Assert that |request|'s client's global object is a Window. 
   1. Let |block| be a boolean, initially false.
   1. Let |report block| be a boolean, initially false.
   1. if |policy|'s sources contains "inline"
@@ -662,6 +664,9 @@ spec:csp3; type:grammar; text:base64-value
   Add an extra step to create a policy container from a fetch response before it returns, that runs
   parse Integrity-Policy headers with response and result.
 
+  Note: The creation of a policy container only happens on navigation responses, but there's no
+        current way to assert that as part of the algorithm.
+
   Expand step 7 of main fetch to call should request be blocked by integrity policy
   and return a network error if it returns "blocked"
 

From b8a537c9a0322814f552063a7608176d763da11a Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Wed, 30 Apr 2025 13:16:57 +0200
Subject: [PATCH 12/19] Add worker handling

---
 index.bs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/index.bs b/index.bs
index d51c7fe..42950b3 100644
--- a/index.bs
+++ b/index.bs
@@ -49,6 +49,7 @@ spec: HTML; urlPrefix: https://html.spec.whatwg.org/C
     text: policy container; url: policy-container
     text: global object; url: global-object
     text: window; url: window
+    text: WorkerGlobalScope; url: workerglobalscope
 
 spec: FETCH; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
@@ -576,7 +577,8 @@ spec:csp3; type:grammar; text:base64-value
   1. Let |policy| be |policy container|'s integrity policy.
   1. Let |report policy| be |policy container|'s report only integrity policy.
   1. If both |policy| and |report policy| are empty integrity policy structs, return "Allowed".
-  1. Assert that |request|'s client's global object is a Window. 
+  1. Let |global| be |request|'s client's global object.
+  1. if |global| is not a Window nor a WorkerGlobalScope, return "Allowed".
   1. Let |block| be a boolean, initially false.
   1. Let |report block| be a boolean, initially false.
   1. if |policy|'s sources contains "inline"
@@ -611,9 +613,11 @@ spec:csp3; type:grammar; text:base64-value
   1. Assert that |request|'s client is not null.
   1. Let |settings object| be |request|'s client.
   1. Let |global| be |settings object|'s global object.
-  1. Assert that |global| is a Window.
-  1. Let |target| be |global|'s associated Document.
-  1. Let |document URL| be the result of strip URL for use in reports on |target|'s document URL.
+  1. Assert that |global| is a Window or a WorkerGlobalScope.
+  1. Let |URL| be an empty URL.
+  1. If |global| is a Window, set |URL| to |global|'s associated Document document URL.
+  1. If |global| is a WorkerGlobalScope, set |URL| to |global|'s URL.
+  1. Let |document URL| be the result of strip URL for use in reports on |URL|.
   1. Let |blocked URL| be the result of strip URL for use in reports on |request|'s URL.
   1. If |block|, for each |endpoint| in |policy|'s endpoints:
      1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows:

From b0176f010ab32a9c6f3ebe006f4431e7931db92c Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Wed, 30 Apr 2025 13:18:34 +0200
Subject: [PATCH 13/19] Remove wrong note

---
 index.bs | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/index.bs b/index.bs
index 42950b3..49223a3 100644
--- a/index.bs
+++ b/index.bs
@@ -668,9 +668,6 @@ spec:csp3; type:grammar; text:base64-value
   Add an extra step to create a policy container from a fetch response before it returns, that runs
   parse Integrity-Policy headers with response and result.
 
-  Note: The creation of a policy container only happens on navigation responses, but there's no
-        current way to assert that as part of the algorithm.
-
   Expand step 7 of main fetch to call should request be blocked by integrity policy
   and return a network error if it returns "blocked"
 

From a75bb368a63aea395aad449ef4b3a66a5c50834a Mon Sep 17 00:00:00 2001
From: Yoav Weiss 
Date: Wed, 30 Apr 2025 15:32:00 +0200
Subject: [PATCH 14/19] Annevk review comments

---
 index.bs | 60 +++++++++++++++++++++++++++-----------------------------
 1 file changed, 29 insertions(+), 31 deletions(-)

diff --git a/index.bs b/index.bs
index 49223a3..aa198e2 100644
--- a/index.bs
+++ b/index.bs
@@ -53,10 +53,6 @@ spec: HTML; urlPrefix: https://html.spec.whatwg.org/C
 
 spec: FETCH; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
-    text: request; url: concept-request 
-    text: response; url: concept-response 
-    text: header list; url: concept-response-header-list
-    text: header; url: concept-header
     text: main fetch; url: main-fetch
 
 spec: RFC7234; urlPrefix: https://tools.ietf.org/html/rfc7234
@@ -81,7 +77,6 @@ spec: RFC9651; urlPrefix: https://tools.ietf.org/html/rfc9651
     text: Dictionary; url: name-dictionaries
     text: inner list; url: name-inner-lists
     text: token; url: name-tokens
-    text: parsing a dictionary; url: name-parsing-a-dictionary
 
 
@@ -530,8 +525,9 @@ spec:csp3; type:grammar; text:base64-value
   The headers' value is a Dictionary [[RFC9651]], with every member-value being an
   inner list of tokens.
   
-  A source is a string. The only possible value for it is "inline".
-  A destination is a string. The only possible value for it is "script".
+  A source is a string. The only possible value for it is "`inline`".
+
+  A destination is a string. The only possible value for it is "`script`".
 
   An integrity policy struct, is a struct that contains the following:
 
@@ -539,35 +535,36 @@ spec:csp3; type:grammar; text:base64-value
     * blocked destinations, a list of destinations, Initially empty.
     * endpoints, a list of strings, initially empty.
 
-  When processing an integrity policy, with |input|, do the following:
-
-  1. Let |integrity policy| be a new integrity policy struct.
-  1. Let |dictionary| be the result of parsing a dictionary with |input|.
-  1. If |dictionary|['sources'] does not exist or if its value contains "inline",
-     append "inline" to |integrity policy|'s sources.
-  1. If |dictionary|['blocked-destinations'] exists:
-    1. If its value contains "script",
-       append "script" to |integrity policy|'s blocked destinations.
-  1. if |dictionary|['endpoints'] exists:
-    1. Set |integrity policy|'s endpoints to |dictionary|['endpoints'].
-  1. return |integrity policy|
+  When processing an integrity policy, with |headers| and |header name|, do the following:
+
+  1. Let |integrityPolicy| be a new integrity policy struct.
+  1. Let |dictionary| be the result of getting a structured field value from |headers|
+     given |header name| and "`dictionary`".
+  1. If |dictionary|["`sources`"] does not exist or if its value contains "`inline`",
+     append "`inline`" to |integrityPolicy|'s sources.
+  1. If |dictionary|["`blocked-destinations`"] exists:
+    1. If its value contains "`script`",
+       append "`script`" to |integrityPolicy|'s blocked destinations.
+  1. If |dictionary|["`endpoints`"] exists:
+    1. Set |integrityPolicy|'s endpoints to |dictionary|['endpoints'].
+  1. Return |integrityPolicy|.
   
   ### Parse Integrity-Policy headers ### {#parse-integrity-policy-headers-section}
-  To parse Integrity-Policy headers, given a Response |response|
+  To parse Integrity-Policy headers, given a Response |response|
   and a policy container |container|, do the following:
 
-  1. Let |headers| be |response|'s header list.
+  1. Let |headers| be |response|'s header list.
   1. If |headers| contains a header
-     whose header name is "Integrity-Policy",
+     whose header name is "`Integrity-Policy`",
      let |container|'s integrity policy be the result of running
      processing an integrity policy with the corresponding header value.
   1. If |headers| contains a header
-     whose header name is "Integrity-Policy-Report-Only",
+     whose header name is "`Integrity-Policy-Report-Only`",
      let |container|'s report only integrity policy be the result of running
      processing an integrity policy with the corresponding header value.
   
   ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy-section}
-  To determine should request be blocked by integrity policy, given a request |request|,
+  To determine should request be blocked by integrity policy, given a request |request|,
   do the following:
 
   1. Let |policy container| be |request|'s policy container.
@@ -581,11 +578,11 @@ spec:csp3; type:grammar; text:base64-value
   1. if |global| is not a Window nor a WorkerGlobalScope, return "Allowed".
   1. Let |block| be a boolean, initially false.
   1. Let |report block| be a boolean, initially false.
-  1. if |policy|'s sources contains "inline"
+  1. if |policy|'s sources contains "`inline`"
      and |policy|'s blocked destinations contains
      |request|'s destination,
      set |block| to true.
-  1. if |policy|'s sources contains "inline"
+  1. if |policy|'s sources contains "`inline`"
      and |report policy|'s blocked destinations contains
      |request|'s destination,
      set |report block| to true.
@@ -606,7 +603,7 @@ spec:csp3; type:grammar; text:base64-value
     };
- To report violation given a Request |request|, a boolean |block|, + To report violation given a Request |request|, a boolean |block|, a boolean |report block|, an integrity policy struct |policy|, and an integrity policy struct |report policy|, do the following: @@ -614,10 +611,11 @@ spec:csp3; type:grammar; text:base64-value 1. Let |settings object| be |request|'s client. 1. Let |global| be |settings object|'s global object. 1. Assert that |global| is a Window or a WorkerGlobalScope. - 1. Let |URL| be an empty URL. - 1. If |global| is a Window, set |URL| to |global|'s associated Document document URL. - 1. If |global| is a WorkerGlobalScope, set |URL| to |global|'s URL. - 1. Let |document URL| be the result of strip URL for use in reports on |URL|. + 1. Let |url| be a URL, initially null. + 1. If |global| is a Window, set |url| to |global|'s associated Document document URL. + 1. If |global| is a WorkerGlobalScope, set |url| to |global|'s URL. + 1. Assert that |url| is a non-null URL. + 1. Let |document URL| be the result of strip URL for use in reports on |url|. 1. Let |blocked URL| be the result of strip URL for use in reports on |request|'s URL. 1. If |block|, for each |endpoint| in |policy|'s endpoints: 1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: From 8c43fe8123acefe4fb7edbd4dbcbba386f194c0a Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Thu, 1 May 2025 19:28:43 +0200 Subject: [PATCH 15/19] more review comments --- index.bs | 70 +++++++++++++++++++++++--------------------------------- 1 file changed, 28 insertions(+), 42 deletions(-) diff --git a/index.bs b/index.bs index aa198e2..8dcc92e 100644 --- a/index.bs +++ b/index.bs @@ -36,21 +36,6 @@ spec: CSP; urlPrefix: https://www.w3.org/TR/CSP3/ type: dfn text: strip url for use in reports; url: strip-url-for-use-in-reports -spec: DOM; urlPrefix: https://dom.spec.whatwg.org/ - type: dfn - text: document url; url: concept-document-url - -spec: INFRA; urlPrefix: https://infra.spec.whatwg.org - type: dfn - text: list; url: list - -spec: HTML; urlPrefix: https://html.spec.whatwg.org/C - type: dfn - text: policy container; url: policy-container - text: global object; url: global-object - text: window; url: window - text: WorkerGlobalScope; url: workerglobalscope - spec: FETCH; urlPrefix: https://fetch.spec.whatwg.org/ type: dfn text: main fetch; url: main-fetch @@ -531,58 +516,59 @@ spec:csp3; type:grammar; text:base64-value An integrity policy struct, is a struct that contains the following: - * sources, a list of sources, Initially empty. - * blocked destinations, a list of destinations, Initially empty. - * endpoints, a list of strings, initially empty. + * sources, a list of sources, initially empty. + * blocked destinations, a list of destinations, initially empty. + * endpoints, a list of strings, initially empty. When processing an integrity policy, with |headers| and |header name|, do the following: - 1. Let |integrityPolicy| be a new integrity policy struct. + 1. Let |integrity policy| be a new integrity policy struct. 1. Let |dictionary| be the result of getting a structured field value from |headers| given |header name| and "`dictionary`". - 1. If |dictionary|["`sources`"] does not exist or if its value contains "`inline`", - append "`inline`" to |integrityPolicy|'s sources. - 1. If |dictionary|["`blocked-destinations`"] exists: + 1. If |dictionary|["`sources`"] does not exist or if its value + contains "`inline`", append "`inline`" to + |integrity policy|'s sources. + 1. If |dictionary|["`blocked-destinations`"] exists: 1. If its value contains "`script`", - append "`script`" to |integrityPolicy|'s blocked destinations. + append "`script`" to |integrity policy|'s blocked destinations. 1. If |dictionary|["`endpoints`"] exists: - 1. Set |integrityPolicy|'s endpoints to |dictionary|['endpoints']. - 1. Return |integrityPolicy|. + 1. Set |integrity policy|'s endpoints to |dictionary|['endpoints']. + 1. Return |integrity policy|. ### Parse Integrity-Policy headers ### {#parse-integrity-policy-headers-section} To parse Integrity-Policy headers, given a Response |response| - and a policy container |container|, do the following: + and a policy container |container|, do the following: 1. Let |headers| be |response|'s header list. 1. If |headers| contains a header whose header name is "`Integrity-Policy`", - let |container|'s integrity policy be the result of running + set |container|'s integrity policy be the result of running processing an integrity policy with the corresponding header value. 1. If |headers| contains a header whose header name is "`Integrity-Policy-Report-Only`", - let |container|'s report only integrity policy be the result of running + set |container|'s report only integrity policy be the result of running processing an integrity policy with the corresponding header value. ### Should request be blocked by Integrity Policy ### {#should-request-be-blocked-by-integrity-policy-section} To determine should request be blocked by integrity policy, given a request |request|, do the following: - 1. Let |policy container| be |request|'s policy container. - 1. if |request|'s integrity metadata is not the empty string + 1. Let |policy container| be |request|'s policy container. + 1. If |request|'s integrity metadata is not the empty string and |request|'s mode is either "cors" or "same-origin", return "Allowed". 1. Let |policy| be |policy container|'s integrity policy. 1. Let |report policy| be |policy container|'s report only integrity policy. 1. If both |policy| and |report policy| are empty integrity policy structs, return "Allowed". - 1. Let |global| be |request|'s client's global object. - 1. if |global| is not a Window nor a WorkerGlobalScope, return "Allowed". + 1. Let |global| be |request|'s client's global object. + 1. If |global| is not a {{Window}} nor a {{WorkerGlobalScope}}, return "Allowed". 1. Let |block| be a boolean, initially false. 1. Let |report block| be a boolean, initially false. - 1. if |policy|'s sources contains "`inline`" + 1. If |policy|'s sources contains "`inline`" and |policy|'s blocked destinations contains |request|'s destination, set |block| to true. - 1. if |policy|'s sources contains "`inline`" + 1. If |policy|'s sources contains "`inline`" and |report policy|'s blocked destinations contains |request|'s destination, set |report block| to true. @@ -607,14 +593,14 @@ spec:csp3; type:grammar; text:base64-value a boolean |report block|, an integrity policy struct |policy|, and an integrity policy struct |report policy|, do the following: - 1. Assert that |request|'s client is not null. + 1. Assert: |request|'s client is not null. 1. Let |settings object| be |request|'s client. - 1. Let |global| be |settings object|'s global object. - 1. Assert that |global| is a Window or a WorkerGlobalScope. - 1. Let |url| be a URL, initially null. - 1. If |global| is a Window, set |url| to |global|'s associated Document document URL. - 1. If |global| is a WorkerGlobalScope, set |url| to |global|'s URL. - 1. Assert that |url| is a non-null URL. + 1. Let |global| be |settings object|'s global object. + 1. Assert: |global| is a {{Window}} or a {{WorkerGlobalScope}}. + 1. Let |url| be null. + 1. If |global| is a {{Window}}, set |url| to |global|'s associated Document's {{Document/URL}}. + 1. If |global| is a {{WorkerGlobalScope}}, set |url| to |global|'s URL. + 1. Assert: |url| a URL. 1. Let |document URL| be the result of strip URL for use in reports on |url|. 1. Let |blocked URL| be the result of strip URL for use in reports on |request|'s URL. 1. If |block|, for each |endpoint| in |policy|'s endpoints: @@ -658,7 +644,7 @@ spec:csp3; type:grammar; text:base64-value ### Integration ### {#integration} - A policy container has extra items: + A policy container has extra items: * integrity policy, an integrity policy struct. * report only integrity policy, an integrity policy struct. From 0c12600aaecec6d761d9c3241f90092af4cd588b Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Tue, 13 May 2025 08:34:37 +0200 Subject: [PATCH 16/19] Make destination a request destination --- index.bs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.bs b/index.bs index 8dcc92e..2335fa4 100644 --- a/index.bs +++ b/index.bs @@ -512,7 +512,7 @@ spec:csp3; type:grammar; text:base64-value A source is a string. The only possible value for it is "`inline`". - A destination is a string. The only possible value for it is "`script`". + A destination is a destination. The only possible value for it is "`script`". An integrity policy struct, is a struct that contains the following: From 117bb355774575de6ce403b7e91634fe41a03f58 Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Wed, 14 May 2025 15:15:35 +0200 Subject: [PATCH 17/19] Review comments --- index.bs | 85 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 44 insertions(+), 41 deletions(-) diff --git a/index.bs b/index.bs index 2335fa4..597f48a 100644 --- a/index.bs +++ b/index.bs @@ -512,7 +512,7 @@ spec:csp3; type:grammar; text:base64-value A source is a string. The only possible value for it is "`inline`". - A destination is a destination. The only possible value for it is "`script`". + A destination is a string. The only possible value for it is "`script`". An integrity policy struct, is a struct that contains the following: @@ -520,20 +520,21 @@ spec:csp3; type:grammar; text:base64-value * blocked destinations, a list of destinations, initially empty. * endpoints, a list of strings, initially empty. - When processing an integrity policy, with |headers| and |header name|, do the following: + When processing an integrity policy, with a header list |headers| + and a header name |headerName|, do the following: - 1. Let |integrity policy| be a new integrity policy struct. + 1. Let |integrityPolicy| be a new integrity policy struct. 1. Let |dictionary| be the result of getting a structured field value from |headers| - given |header name| and "`dictionary`". + given |headerName| and "`dictionary`". 1. If |dictionary|["`sources`"] does not exist or if its value contains "`inline`", append "`inline`" to - |integrity policy|'s sources. + |integrityPolicy|'s sources. 1. If |dictionary|["`blocked-destinations`"] exists: 1. If its value contains "`script`", - append "`script`" to |integrity policy|'s blocked destinations. + append "`script`" to |integrityPolicy|'s blocked destinations. 1. If |dictionary|["`endpoints`"] exists: - 1. Set |integrity policy|'s endpoints to |dictionary|['endpoints']. - 1. Return |integrity policy|. + 1. Set |integrityPolicy|'s endpoints to |dictionary|['endpoints']. + 1. Return |integrityPolicy|. ### Parse Integrity-Policy headers ### {#parse-integrity-policy-headers-section} To parse Integrity-Policy headers, given a Response |response| @@ -541,11 +542,13 @@ spec:csp3; type:grammar; text:base64-value 1. Let |headers| be |response|'s header list. 1. If |headers| contains a header - whose header name is "`Integrity-Policy`", + whose byte-lowercased header name's isomorphic decode + is "`integrity-policy`", set |container|'s integrity policy be the result of running processing an integrity policy with the corresponding header value. 1. If |headers| contains a header - whose header name is "`Integrity-Policy-Report-Only`", + whose byte-lowercased header name's isomorphic decode + is "`integrity-policy-report-only`", set |container|'s report only integrity policy be the result of running processing an integrity policy with the corresponding header value. @@ -553,28 +556,28 @@ spec:csp3; type:grammar; text:base64-value To determine should request be blocked by integrity policy, given a request |request|, do the following: - 1. Let |policy container| be |request|'s policy container. + 1. Let |policyContainer| be |request|'s policy container. 1. If |request|'s integrity metadata is not the empty string - and |request|'s mode is either "cors" or "same-origin", + and |request|'s mode is either "`cors`" or "`same-origin`", return "Allowed". - 1. Let |policy| be |policy container|'s integrity policy. - 1. Let |report policy| be |policy container|'s report only integrity policy. - 1. If both |policy| and |report policy| are empty integrity policy structs, return "Allowed". + 1. Let |policy| be |policyContainer|'s integrity policy. + 1. Let |reportPolicy| be |policyContainer|'s report only integrity policy. + 1. If both |policy| and |reportPolicy| are empty integrity policy structs, return "Allowed". 1. Let |global| be |request|'s client's global object. - 1. If |global| is not a {{Window}} nor a {{WorkerGlobalScope}}, return "Allowed". + 1. If |global| is not a {{Window}} nor a {{WorkerGlobalScope}}, return "`Allowed`". 1. Let |block| be a boolean, initially false. - 1. Let |report block| be a boolean, initially false. + 1. Let |reportBlock| be a boolean, initially false. 1. If |policy|'s sources contains "`inline`" and |policy|'s blocked destinations contains |request|'s destination, set |block| to true. 1. If |policy|'s sources contains "`inline`" - and |report policy|'s blocked destinations contains + and |reportPolicy|'s blocked destinations contains |request|'s destination, - set |report block| to true. - 1. If |block| or |report block|, report violation with |request|, |block|, |report block|, - |policy| and |report policy|. - 1. If |block|, return "Blocked". Otherwise, return "Allowed". + set |reportBlock| to true. + 1. If |block| is true or |reportBlock| is true, then report violation + with |request|, |block|, |reportBlock|, |policy| and |reportPolicy|. + 1. If |block| is true, then return "`Blocked`"; otherwise "`Allowed`". ### Report violations ### {#report-violations} @@ -590,57 +593,57 @@ spec:csp3; type:grammar; text:base64-value To report violation given a Request |request|, a boolean |block|, - a boolean |report block|, an integrity policy struct |policy|, - and an integrity policy struct |report policy|, do the following: + a boolean |reportBlock|, an integrity policy struct |policy|, + and an integrity policy struct |reportPolicy|, do the following: 1. Assert: |request|'s client is not null. - 1. Let |settings object| be |request|'s client. - 1. Let |global| be |settings object|'s global object. + 1. Let |settingsObject| be |request|'s client. + 1. Let |global| be |settingsObject|'s global object. 1. Assert: |global| is a {{Window}} or a {{WorkerGlobalScope}}. 1. Let |url| be null. 1. If |global| is a {{Window}}, set |url| to |global|'s associated Document's {{Document/URL}}. 1. If |global| is a {{WorkerGlobalScope}}, set |url| to |global|'s URL. - 1. Assert: |url| a URL. - 1. Let |document URL| be the result of strip URL for use in reports on |url|. - 1. Let |blocked URL| be the result of strip URL for use in reports on |request|'s URL. + 1. Assert: |url| is a URL. + 1. Let |documentURL| be the result of strip URL for use in reports on |url|. + 1. Let |blockedURL| be the result of strip URL for use in reports on |request|'s URL. 1. If |block|, for each |endpoint| in |policy|'s endpoints: 1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: : {{IntegrityPolicyViolationReportBody/documentURL}} - :: |document URL| + :: |documentURL| : {{IntegrityPolicyViolationReportBody/blockedURL}} - :: |blocked URL| + :: |blockedURL| : {{IntegrityPolicyViolationReportBody/destination}} :: |request|'s destination : {{IntegrityPolicyViolationReportBody/reportOnly}} :: false 2. Generate and queue a report with the following arguments: : context - :: |settings object| + :: |settingsObject| : type - :: "integrity-policy-violation" + :: "`integrity-policy-violation`" : destination :: |endpoint| : data :: |body| - 1. If |report block|, for each |endpoint| in |policy|'s endpoints: - 1. Let |report body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: + 1. If |reportBlock|, for each |endpoint| in |reportPolicy|'s endpoints: + 1. Let |reportBody| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: : {{IntegrityPolicyViolationReportBody/documentURL}} - :: |document URL| + :: |documentURL| : {{IntegrityPolicyViolationReportBody/blockedURL}} - :: |blocked URL| + :: |blockedURL| : {{IntegrityPolicyViolationReportBody/destination}} :: |request|'s destination : {{IntegrityPolicyViolationReportBody/reportOnly}} :: true 2. Generate and queue a report with the following arguments: : context - :: |settings object| + :: |settingsObject| : type - :: "integrity-policy-violation" + :: "`integrity-policy-violation`" : destination :: |endpoint| : data - :: |report body| + :: |reportBody| ### Integration ### {#integration} @@ -653,7 +656,7 @@ spec:csp3; type:grammar; text:base64-value parse Integrity-Policy headers with response and result. Expand step 7 of main fetch to call should request be blocked by integrity policy - and return a network error if it returns "blocked" + and return a network error if it returns "`Blocked`". # Proxies # {#proxies} From 562969359ef2919aff5a29533727aca27df3bae7 Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Wed, 14 May 2025 22:09:06 +0200 Subject: [PATCH 18/19] More fixups --- index.bs | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/index.bs b/index.bs index 597f48a..dad9412 100644 --- a/index.bs +++ b/index.bs @@ -541,14 +541,10 @@ spec:csp3; type:grammar; text:base64-value and a policy container |container|, do the following: 1. Let |headers| be |response|'s header list. - 1. If |headers| contains a header - whose byte-lowercased header name's isomorphic decode - is "`integrity-policy`", + 1. If |headers| contains ``integrity-policy``, set |container|'s integrity policy be the result of running processing an integrity policy with the corresponding header value. - 1. If |headers| contains a header - whose byte-lowercased header name's isomorphic decode - is "`integrity-policy-report-only`", + 1. If |headers| contains ``integrity-policy-report-only``, set |container|'s report only integrity policy be the result of running processing an integrity policy with the corresponding header value. @@ -606,7 +602,7 @@ spec:csp3; type:grammar; text:base64-value 1. Assert: |url| is a URL. 1. Let |documentURL| be the result of strip URL for use in reports on |url|. 1. Let |blockedURL| be the result of strip URL for use in reports on |request|'s URL. - 1. If |block|, for each |endpoint| in |policy|'s endpoints: + 1. If |block| is true, for each |endpoint| in |policy|'s endpoints: 1. Let |body| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: : {{IntegrityPolicyViolationReportBody/documentURL}} :: |documentURL| @@ -625,7 +621,7 @@ spec:csp3; type:grammar; text:base64-value :: |endpoint| : data :: |body| - 1. If |reportBlock|, for each |endpoint| in |reportPolicy|'s endpoints: + 1. If |reportBlock| is true, for each |endpoint| in |reportPolicy|'s endpoints: 1. Let |reportBody| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: : {{IntegrityPolicyViolationReportBody/documentURL}} :: |documentURL| From 6b7e05d9232d7aab03afb162378007a72e501eb5 Mon Sep 17 00:00:00 2001 From: Yoav Weiss Date: Fri, 16 May 2025 14:14:10 +0200 Subject: [PATCH 19/19] Link to reporting params --- index.bs | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/index.bs b/index.bs index dad9412..f52cecd 100644 --- a/index.bs +++ b/index.bs @@ -613,13 +613,13 @@ spec:csp3; type:grammar; text:base64-value : {{IntegrityPolicyViolationReportBody/reportOnly}} :: false 2. Generate and queue a report with the following arguments: - : context + : context :: |settingsObject| - : type + : type :: "`integrity-policy-violation`" - : destination + : destination :: |endpoint| - : data + : data :: |body| 1. If |reportBlock| is true, for each |endpoint| in |reportPolicy|'s endpoints: 1. Let |reportBody| be a new {{IntegrityPolicyViolationReportBody}}, initialized as follows: @@ -632,13 +632,13 @@ spec:csp3; type:grammar; text:base64-value : {{IntegrityPolicyViolationReportBody/reportOnly}} :: true 2. Generate and queue a report with the following arguments: - : context + : context :: |settingsObject| - : type + : type :: "`integrity-policy-violation`" - : destination + : destination :: |endpoint| - : data + : data :: |reportBody| ### Integration ### {#integration}