Skip to content

Use "Strip URL" from the Reporting API #734

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Use "Strip URL" from the Reporting API #734

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 11 additions & 26 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1120,7 +1120,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
1. Let |hash| be the [=concatenation=] of |algorithm|, U+2D (-), and |h|.
1. Let |global| be the |request|'s [=request/client=]'s [=/global object=].
1. If |global| is not a {{Window}}, return.
1. Let |stripped document URL| to be the result of executing [[#strip-url-for-use-in-reports]]
1. Let |stripped document URL| to be the result of executing [=strip URL for use in reports=]
on |global|'s [=associated document|document=]'s [=Document/URL=].
1. If |policy|'s [=directive set=] does not contain a [=directive=] named "report-to", return.
1. Let |report-to directive| be a [=directive=] named "report-to" from |policy|'s [=directive
Expand Down Expand Up @@ -1744,7 +1744,7 @@ Content-Type: application/reports+json

1. Assert: |resource| is a [=/URL=] or a [=string=].

2. If |resource| is a [=/URL=], return the result of executing [[#strip-url-for-use-in-reports]] on
2. If |resource| is a [=/URL=], return the result of executing [=strip URL for use in reports=] on
|resource|.

3. Return |resource|.
Expand All @@ -1761,10 +1761,10 @@ Content-Type: application/reports+json
follows:

: "`document-uri`"
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">url</a>.
: "`referrer`"
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">referrer</a>.
: "`blocked-uri`"
:: The result of executing [[#obtain-violation-blocked-uri]] on |violation|'s
Expand Down Expand Up @@ -1793,7 +1793,7 @@ Content-Type: application/reports+json

2. If |violation|'s <a for="violation">source file</a> is not null:

1. Set |body|["`source-file`'] to the result of executing [[#strip-url-for-use-in-reports]]
1. Set |body|["`source-file`'] to the result of executing [=strip URL for use in reports=]
on |violation|'s <a for="violation">source file</a>.

2. Set |body|["`line-number`"] to |violation|'s
Expand All @@ -1808,21 +1808,6 @@ Content-Type: application/reports+json
4. Return the result of <a>serialize an infra value to JSON bytes</a> given
«[ "csp-report" → body ]».

<h3 id="strip-url-for-use-in-reports" algorithm>Strip URL for use in reports</h3>
Given a [=/URL=] |url|, this algorithm returns a string representing the URL for use in violation
reports:

1. If |url|'s <a for="url">scheme</a> is not an <a>HTTP(S) scheme</a>,
then return |url|'s <a for="url">scheme</a>.

2. Set |url|’s <a for="url">fragment</a> to the empty string.

3. Set |url|’s <a for="url">username</a> to the empty string.

4. Set |url|’s <a for="url">password</a> to the empty string.

5. Return the result of executing the <a>URL serializer</a> on |url|.

<h3 id="report-violation" algorithm>
Report a |violation|
</h3>
Expand Down Expand Up @@ -1865,10 +1850,10 @@ Content-Type: application/reports+json
interface at |target| with its attributes initialized as follows:

: {{SecurityPolicyViolationEvent/documentURI}}
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">url</a>.
: {{SecurityPolicyViolationEvent/referrer}}
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">referrer</a>.
: {{SecurityPolicyViolationEvent/blockedURI}}
:: The result of executing [[#obtain-violation-blocked-uri]] on |violation|'s
Expand All @@ -1883,7 +1868,7 @@ Content-Type: application/reports+json
: {{SecurityPolicyViolationEvent/disposition}}
:: |violation|'s <a for="violation">disposition</a>
: {{SecurityPolicyViolationEvent/sourceFile}}
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">source file</a>, if |violation|'s
<a for="violation">source file</a> is not null, or null otherwise.
: {{SecurityPolicyViolationEvent/statusCode}}
Expand Down Expand Up @@ -1976,11 +1961,11 @@ Content-Type: application/reports+json
follows:

: {{CSPViolationReportBody/documentURL}}
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">url</a>.

: {{CSPViolationReportBody/referrer}}
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">referrer</a>.

: {{CSPViolationReportBody/blockedURL}}
Expand All @@ -1995,7 +1980,7 @@ Content-Type: application/reports+json
<a for="violation">policy</a>.

: {{CSPViolationReportBody/sourceFile}}
:: The result of executing [[#strip-url-for-use-in-reports]] on |violation|'s
:: The result of executing [=strip URL for use in reports=] on |violation|'s
<a for="violation">source file</a>, if |violation|'s
<a for="violation">source file</a> is not null, or null otherwise.

Expand Down