{"action":"created","comment":{"url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/comments/64164831","id":64164831,"diff_hunk":"@@ -343,7 +368,65 @@ implementation detail. It is not an API that implementors\n provide to web applications. It is used in this document\n only to simplify the algorithm description.\n \n-## Response verification algorithms ## {#verification-algorithms}\n+## Request verification algorithms ## {#request-verification-algorithms}\n+\n+### Opting-in  ### {#opt-in-require-sri-for}\n+\n+Authors may opt a {{Document}} to require SRI metadata be present for \n+some resource types via a <dfn export>require-sri-for</dfn> <a>Content\n+Security Policy</a> directive defined by the following ABNF grammar:\n+\n+<pre dfn-type=\"grammar\" link-type=\"grammar\">\n+    directive-name  = \"require-sri-for\"\n+    directive-value = <a grammar>token</a> *( <a>RWS</a> <a>token</a> )\n+</pre>\n+\n+The following list contains the set of <dfn noexport>known tokens</dfn>:\n+\n+  * `script` requires SRI for scripts\n+  * `style` requires SRI for style sheets\n+\n+### Parsing `require-sri-for` ### {#parse-require-sri-for}\n+\n+Given a string (|token list|), this algorithm returns a list of resource\n+types which will require integrity checks:\n+\n+1.  Let the set of |protected resource types| that require SRI be the empty set.\n+\n+2.  For each |token| in the result of <a lt=\"split a string on spaces\">\n+    splitting |token list| on spaces</a> if token matches the grammar\n+    for <a>require-sri-for</a>, add |token| to |protected resource types|\n+    if |token| is a <a>known token</a>. Otherwise, ignore the token.\n+\n+3.  Return the set of |protected resource types|.\n+\n+### Apply |algorithm| to |request| ### {#apply-algorithm-to-request}\n+\n+This directive’s <a>pre-request check</a> is as follows:\n+\n+Given a <a>request</a> (|request|) and a <a>policy</a> (|policy|):\n+\n+1.  Let |protected resource types| be the result of executing\n+    [[#parse-require-sri-for]] on this <a>directive</a>'s <a lt=\"directive value\">value</a>.\n+\n+2.  If |request|'s <a>destination</a> is a <a>ASCII case-insensitive match</a> for at least\n+    one token in |protected resource types|, and |request|'s integrity metadata\n+    is the empty string:\n+\n+      1.  Let |violation| be the result of executing <a lt=\"create a violation object for global\">","path":"index.bikeshed.bs","position":100,"original_position":100,"commit_id":"884f3f00087362e2253010992a31903bf434d02e","original_commit_id":"884f3f00087362e2253010992a31903bf434d02e","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"body":"Looking at this again, I don't think you need to do the reporting here. It ought to be taken care of by https://w3c.github.io/webappsec-csp/#should-block-request (which eventually calls into the `pre-request check`. You should be able to simply return `blocked` when relevant.","created_at":"2016-05-23T03:00:40Z","updated_at":"2016-05-23T03:00:40Z","html_url":"https://github.com/w3c/webappsec-subresource-integrity/pull/32#discussion_r64164831","pull_request_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32","_links":{"self":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/comments/64164831"},"html":{"href":"https://github.com/w3c/webappsec-subresource-integrity/pull/32#discussion_r64164831"},"pull_request":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32"}}},"pull_request":{"url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32","id":69082442,"html_url":"https://github.com/w3c/webappsec-subresource-integrity/pull/32","diff_url":"https://github.com/w3c/webappsec-subresource-integrity/pull/32.diff","patch_url":"https://github.com/w3c/webappsec-subresource-integrity/pull/32.patch","issue_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues/32","number":32,"state":"open","locked":false,"title":"attempt to write down `require-sri-for` directive as part of SRI","user":{"login":"shekyan","id":1631049,"avatar_url":"https://avatars.githubusercontent.com/u/1631049?v=3","gravatar_id":"","url":"https://api.github.com/users/shekyan","html_url":"https://github.com/shekyan","followers_url":"https://api.github.com/users/shekyan/followers","following_url":"https://api.github.com/users/shekyan/following{/other_user}","gists_url":"https://api.github.com/users/shekyan/gists{/gist_id}","starred_url":"https://api.github.com/users/shekyan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shekyan/subscriptions","organizations_url":"https://api.github.com/users/shekyan/orgs","repos_url":"https://api.github.com/users/shekyan/repos","events_url":"https://api.github.com/users/shekyan/events{/privacy}","received_events_url":"https://api.github.com/users/shekyan/received_events","type":"User","site_admin":false},"body":"Background: https://github.com/w3c/webappsec-csp/pull/85.","created_at":"2016-05-05T22:43:37Z","updated_at":"2016-05-23T03:00:40Z","closed_at":null,"merged_at":null,"merge_commit_sha":"645729a972d1018d22fea35d6d9ce87e6f51494a","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32/commits","review_comments_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32/comments","review_comment_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/comments{/number}","comments_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues/32/comments","statuses_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/statuses/884f3f00087362e2253010992a31903bf434d02e","head":{"label":"shekyan:require-sri-for","ref":"require-sri-for","sha":"884f3f00087362e2253010992a31903bf434d02e","user":{"login":"shekyan","id":1631049,"avatar_url":"https://avatars.githubusercontent.com/u/1631049?v=3","gravatar_id":"","url":"https://api.github.com/users/shekyan","html_url":"https://github.com/shekyan","followers_url":"https://api.github.com/users/shekyan/followers","following_url":"https://api.github.com/users/shekyan/following{/other_user}","gists_url":"https://api.github.com/users/shekyan/gists{/gist_id}","starred_url":"https://api.github.com/users/shekyan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shekyan/subscriptions","organizations_url":"https://api.github.com/users/shekyan/orgs","repos_url":"https://api.github.com/users/shekyan/repos","events_url":"https://api.github.com/users/shekyan/events{/privacy}","received_events_url":"https://api.github.com/users/shekyan/received_events","type":"User","site_admin":false},"repo":{"id":58152090,"name":"webappsec-subresource-integrity","full_name":"shekyan/webappsec-subresource-integrity","owner":{"login":"shekyan","id":1631049,"avatar_url":"https://avatars.githubusercontent.com/u/1631049?v=3","gravatar_id":"","url":"https://api.github.com/users/shekyan","html_url":"https://github.com/shekyan","followers_url":"https://api.github.com/users/shekyan/followers","following_url":"https://api.github.com/users/shekyan/following{/other_user}","gists_url":"https://api.github.com/users/shekyan/gists{/gist_id}","starred_url":"https://api.github.com/users/shekyan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shekyan/subscriptions","organizations_url":"https://api.github.com/users/shekyan/orgs","repos_url":"https://api.github.com/users/shekyan/repos","events_url":"https://api.github.com/users/shekyan/events{/privacy}","received_events_url":"https://api.github.com/users/shekyan/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/shekyan/webappsec-subresource-integrity","description":"WebAppSec Subresource Integrity","fork":true,"url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity","forks_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/forks","keys_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/teams","hooks_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/hooks","issue_events_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/issues/events{/number}","events_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/events","assignees_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/assignees{/user}","branches_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/branches{/branch}","tags_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/tags","blobs_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/git/refs{/sha}","trees_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/statuses/{sha}","languages_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/languages","stargazers_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/stargazers","contributors_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/contributors","subscribers_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/subscribers","subscription_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/subscription","commits_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/commits{/sha}","git_commits_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/git/commits{/sha}","comments_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/comments{/number}","issue_comment_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/issues/comments{/number}","contents_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/contents/{+path}","compare_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/merges","archive_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/downloads","issues_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/issues{/number}","pulls_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/pulls{/number}","milestones_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/milestones{/number}","notifications_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/labels{/name}","releases_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/releases{/id}","deployments_url":"https://api.github.com/repos/shekyan/webappsec-subresource-integrity/deployments","created_at":"2016-05-05T18:29:42Z","updated_at":"2016-05-05T18:29:43Z","pushed_at":"2016-05-19T00:05:57Z","git_url":"git://github.com/shekyan/webappsec-subresource-integrity.git","ssh_url":"git@github.com:shekyan/webappsec-subresource-integrity.git","clone_url":"https://github.com/shekyan/webappsec-subresource-integrity.git","svn_url":"https://github.com/shekyan/webappsec-subresource-integrity","homepage":"https://w3c.github.io/webappsec-subresource-integrity/","size":443,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"w3c:master","ref":"master","sha":"297f09fb1b0a71132a6cdda80e49819a8651470c","user":{"login":"w3c","id":379216,"avatar_url":"https://avatars.githubusercontent.com/u/379216?v=3","gravatar_id":"","url":"https://api.github.com/users/w3c","html_url":"https://github.com/w3c","followers_url":"https://api.github.com/users/w3c/followers","following_url":"https://api.github.com/users/w3c/following{/other_user}","gists_url":"https://api.github.com/users/w3c/gists{/gist_id}","starred_url":"https://api.github.com/users/w3c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w3c/subscriptions","organizations_url":"https://api.github.com/users/w3c/orgs","repos_url":"https://api.github.com/users/w3c/repos","events_url":"https://api.github.com/users/w3c/events{/privacy}","received_events_url":"https://api.github.com/users/w3c/received_events","type":"Organization","site_admin":false},"repo":{"id":43490935,"name":"webappsec-subresource-integrity","full_name":"w3c/webappsec-subresource-integrity","owner":{"login":"w3c","id":379216,"avatar_url":"https://avatars.githubusercontent.com/u/379216?v=3","gravatar_id":"","url":"https://api.github.com/users/w3c","html_url":"https://github.com/w3c","followers_url":"https://api.github.com/users/w3c/followers","following_url":"https://api.github.com/users/w3c/following{/other_user}","gists_url":"https://api.github.com/users/w3c/gists{/gist_id}","starred_url":"https://api.github.com/users/w3c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w3c/subscriptions","organizations_url":"https://api.github.com/users/w3c/orgs","repos_url":"https://api.github.com/users/w3c/repos","events_url":"https://api.github.com/users/w3c/events{/privacy}","received_events_url":"https://api.github.com/users/w3c/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/w3c/webappsec-subresource-integrity","description":"WebAppSec Subresource Integrity","fork":false,"url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity","forks_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/forks","keys_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/teams","hooks_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/hooks","issue_events_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues/events{/number}","events_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/events","assignees_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/assignees{/user}","branches_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/branches{/branch}","tags_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/tags","blobs_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/git/refs{/sha}","trees_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/statuses/{sha}","languages_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/languages","stargazers_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/stargazers","contributors_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/contributors","subscribers_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/subscribers","subscription_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/subscription","commits_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/commits{/sha}","git_commits_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/git/commits{/sha}","comments_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/comments{/number}","issue_comment_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues/comments{/number}","contents_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/contents/{+path}","compare_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/merges","archive_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/downloads","issues_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues{/number}","pulls_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls{/number}","milestones_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/milestones{/number}","notifications_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/labels{/name}","releases_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/releases{/id}","deployments_url":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/deployments","created_at":"2015-10-01T10:36:51Z","updated_at":"2016-05-14T21:36:50Z","pushed_at":"2016-05-19T16:01:21Z","git_url":"git://github.com/w3c/webappsec-subresource-integrity.git","ssh_url":"git@github.com:w3c/webappsec-subresource-integrity.git","clone_url":"https://github.com/w3c/webappsec-subresource-integrity.git","svn_url":"https://github.com/w3c/webappsec-subresource-integrity","homepage":"https://w3c.github.io/webappsec-subresource-integrity/","size":456,"stargazers_count":16,"watchers_count":16,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":8,"mirror_url":null,"open_issues_count":14,"forks":8,"open_issues":14,"watchers":16,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32"},"html":{"href":"https://github.com/w3c/webappsec-subresource-integrity/pull/32"},"issue":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues/32"},"comments":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/issues/32/comments"},"review_comments":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32/comments"},"review_comment":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/pulls/32/commits"},"statuses":{"href":"https://api.github.com/repos/w3c/webappsec-subresource-integrity/statuses/884f3f00087362e2253010992a31903bf434d02e"}}}}
{"actor":{"display_login":"mikewest"}}