{"action":"created","comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/comments/91577148","pull_request_review_id":12087187,"id":91577148,"diff_hunk":"@@ -1001,6 +1014,113 @@ <h4 id=\"effective-directive\" algorithm>\n \n   2.  Return `null`.\n \n+  <h4 id=\"effective-source-list\" algorithm>\n+    Get the effective <a>source list</a> for a <a>source list</a>,\n+    <a for=\"/\">origin</a>, and <a for=\"directive\">name</a>.\n+  </h4>\n+\n+  <a>Source list</a> is an <dfn for=\"source list\">effective</dfn>\n+  <a>source list</a> for a given <a>source list</a>, if it \n+  <a for=\"set\">contains</a> all of the allowed and honored expressions for that\n+  <a>directive</a> name.\n+\n+  <div class=\"example\">\n+\n+    For any directive:\n+    <pre>\n+      https: wss: 'none'\n+    </pre>\n+    The effective source list is \"http: wss:\" since \"'none'\" has no effect when\n+    it is not the only source.\n+\n+    For \"`style-src`\":\n+    <pre>\n+      http://example.com 'strict-dynamic' 'unsafe-inline'\n+    </pre>\n+    The effective source list is \"http://example.com 'unsafe-inline'\" since\n+    \"'strict-dynamic'\" is ignored in non \"`script-src`\" directives.\n+\n+    For \"`script-src`\":\n+    <pre>\n+      http://example.com 'strict-dynamic' 'unsafe-inline'\n+    </pre>\n+    The effective source list is \"'strict-dynamic'\" since\n+    \"'strict-dynamic'\" in \"`script-src`\" case does not honor hash and scheme\n+    source expressions nor \"'unsafe-inline'\".\n+  </div>\n+\n+  Given a <a>source list</a> (|source list|), <a for=\"request\">origin</a>\n+  (|origin|), and string (|directive|), the following algorithm returns a\n+  an <a for=\"source list\">effective</a> <a>source list</a> for |source list|.\n+\n+  1.  If |source list| <a for=\"set\">is empty</a> or « 'none' », return\n+      |source list|.\n+\n+  2.  If |source list| <a for=\"set\">contains</a> a token that is an\n+      <a>ASCII case-insensitive</a> match to the <a grammar>`keyword-source`</a>\n+      \"<a grammar>`'self'`</a>\":\n+\n+      1.  Remove that token from |source list|.\n+\n+      2.  <a for=\"set\">Append</a> the result of executing [[#rewrite-self]]\n+          given |origin| to |source list|.\n+\n+  3.  Let |effective| be an empty <a>source list</a>.\n+\n+  4.  If |directive| is \"`plugin-types`\":\n+\n+      1.  For each |expression| in |source list|:\n+\n+          1.  If |expression| does not match <a grammar>`media-type`</a>,\n+              <a for=\"iteration\">continue</a>.\n+\n+          2.  If |expression|'s <a>type</a> is not a valid type according to\n+              RFC 2045, <a for=\"iteration\">continue</a>.\n+\n+          3.  If |expression|'s <a>subtype</a> is not a valid sybtype according\n+              to RFC 2045, <a for=\"iteration\">continue</a>.\n+\n+          4.  <a for=\"set\">Append</a> |expression| to |effective|.\n+\n+      2.  If |effective| <a for=\"set\">is empty</a>, return « 'none' ». \n+\n+      3.  Return |effective|.\n+\n+  5.  For each |expression| in |source list|:\n+\n+      1.  If |expression| matches <a grammar>`keyword-source`</a> grammar\n+          and |directive| is not \"`script-src`\" or \"`style-src`\",\n+          <a for=\"iteration\">continue</a>.\n+\n+      2.  If |directive| is \"`script-src`\" and |source list|\n+          <a for=\"set\">contains</a> a token that is an\n+          <a>ASCII case-insensitive</a> match to the\n+          <a grammar>`keyword-source`</a> \"<a grammar>`'strict-dynamic'`</a>\":\n+\n+          1.  If |expression| matches <a grammar>`host-source`</a>, \n+              <a grammar>`scheme-source`</a> grammar or\n+              <a grammar>`keyword-source`</a>\n+              \"<a grammar>`'unsafe-inline'`</a>\",\n+              <a for=\"iteration\">continue</a>.\n+\n+      3.  If |expression| is an <a>ASCII case-insensitive</a> match to the\n+          <a grammar>`keyword-source`</a> \"<a grammar>`'strict-dynamic'`</a>\"\n+          and |directive| is not \"`script-src`\",\n+          <a for=\"iteration\">continue</a>.\n+\n+      4.  If |directive| is \"`frame-ancestors`\" and |expression| matches \n+          <a grammar>`nonce-source`</a> or <a grammar>`hash-source`</a> grammar, \n+          <a for=\"iteration\">continue</a>.\n+\n+      5.  If |expression| is an <a>ASCII case-insensitive</a> match to \n+          \"<a grammar>`'none'`</a>\", <a for=\"iteration\">continue</a>.\n+\n+      6.  <a for=\"set\">Append</a> |expression| to |effective|.\n+\n+  6.  If |effective| <a for=\"set\">is empty</a>, return « 'none' ». ","path":"embedded/index.src.html","position":138,"original_position":138,"commit_id":"031a6c97ff083ad04004d14f862699de891e41cc","original_commit_id":"031a6c97ff083ad04004d14f862699de891e41cc","user":{"login":"Sun77789","id":5797085,"avatar_url":"https://avatars.githubusercontent.com/u/5797085?v=3","gravatar_id":"","url":"https://api.github.com/users/Sun77789","html_url":"https://github.com/Sun77789","followers_url":"https://api.github.com/users/Sun77789/followers","following_url":"https://api.github.com/users/Sun77789/following{/other_user}","gists_url":"https://api.github.com/users/Sun77789/gists{/gist_id}","starred_url":"https://api.github.com/users/Sun77789/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sun77789/subscriptions","organizations_url":"https://api.github.com/users/Sun77789/orgs","repos_url":"https://api.github.com/users/Sun77789/repos","events_url":"https://api.github.com/users/Sun77789/events{/privacy}","received_events_url":"https://api.github.com/users/Sun77789/received_events","type":"User","site_admin":false},"body":"This is to make sure we properly handle source lists with ignored keywords. From my understand, if the following directive is specified:\r\n\"style-src 'strict-dynamic'\"\r\nSince  'strict-dynamic' is ignored, then effectively we have \"style-src \" which means \"style-src 'none'\"?","created_at":"2016-12-08T18:36:41Z","updated_at":"2016-12-08T18:36:41Z","html_url":"https://github.com/w3c/webappsec-csp/pull/165#discussion_r91577148","pull_request_url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165","_links":{"self":{"href":"https://api.github.com/repos/w3c/webappsec-csp/pulls/comments/91577148"},"html":{"href":"https://github.com/w3c/webappsec-csp/pull/165#discussion_r91577148"},"pull_request":{"href":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165"}}},"pull_request":{"url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165","id":97145597,"html_url":"https://github.com/w3c/webappsec-csp/pull/165","diff_url":"https://github.com/w3c/webappsec-csp/pull/165.diff","patch_url":"https://github.com/w3c/webappsec-csp/pull/165.patch","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/165","number":165,"state":"open","locked":false,"title":"EE: Effective source list","user":{"login":"Sun77789","id":5797085,"avatar_url":"https://avatars.githubusercontent.com/u/5797085?v=3","gravatar_id":"","url":"https://api.github.com/users/Sun77789","html_url":"https://github.com/Sun77789","followers_url":"https://api.github.com/users/Sun77789/followers","following_url":"https://api.github.com/users/Sun77789/following{/other_user}","gists_url":"https://api.github.com/users/Sun77789/gists{/gist_id}","starred_url":"https://api.github.com/users/Sun77789/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sun77789/subscriptions","organizations_url":"https://api.github.com/users/Sun77789/orgs","repos_url":"https://api.github.com/users/Sun77789/repos","events_url":"https://api.github.com/users/Sun77789/events{/privacy}","received_events_url":"https://api.github.com/users/Sun77789/received_events","type":"User","site_admin":false},"body":"@mikewest \r\n","created_at":"2016-12-08T15:43:17Z","updated_at":"2016-12-08T18:36:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1e2d7941413dd6823ebf35bd426efe7d3f7e146c","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165/commits","review_comments_url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165/comments","review_comment_url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/comments{/number}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/165/comments","statuses_url":"https://api.github.com/repos/w3c/webappsec-csp/statuses/031a6c97ff083ad04004d14f862699de891e41cc","head":{"label":"Sun77789:effective_source_list","ref":"effective_source_list","sha":"031a6c97ff083ad04004d14f862699de891e41cc","user":{"login":"Sun77789","id":5797085,"avatar_url":"https://avatars.githubusercontent.com/u/5797085?v=3","gravatar_id":"","url":"https://api.github.com/users/Sun77789","html_url":"https://github.com/Sun77789","followers_url":"https://api.github.com/users/Sun77789/followers","following_url":"https://api.github.com/users/Sun77789/following{/other_user}","gists_url":"https://api.github.com/users/Sun77789/gists{/gist_id}","starred_url":"https://api.github.com/users/Sun77789/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sun77789/subscriptions","organizations_url":"https://api.github.com/users/Sun77789/orgs","repos_url":"https://api.github.com/users/Sun77789/repos","events_url":"https://api.github.com/users/Sun77789/events{/privacy}","received_events_url":"https://api.github.com/users/Sun77789/received_events","type":"User","site_admin":false},"repo":{"id":72195104,"name":"webappsec-csp","full_name":"Sun77789/webappsec-csp","owner":{"login":"Sun77789","id":5797085,"avatar_url":"https://avatars.githubusercontent.com/u/5797085?v=3","gravatar_id":"","url":"https://api.github.com/users/Sun77789","html_url":"https://github.com/Sun77789","followers_url":"https://api.github.com/users/Sun77789/followers","following_url":"https://api.github.com/users/Sun77789/following{/other_user}","gists_url":"https://api.github.com/users/Sun77789/gists{/gist_id}","starred_url":"https://api.github.com/users/Sun77789/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sun77789/subscriptions","organizations_url":"https://api.github.com/users/Sun77789/orgs","repos_url":"https://api.github.com/users/Sun77789/repos","events_url":"https://api.github.com/users/Sun77789/events{/privacy}","received_events_url":"https://api.github.com/users/Sun77789/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Sun77789/webappsec-csp","description":"WebAppSec Content Security Policy","fork":true,"url":"https://api.github.com/repos/Sun77789/webappsec-csp","forks_url":"https://api.github.com/repos/Sun77789/webappsec-csp/forks","keys_url":"https://api.github.com/repos/Sun77789/webappsec-csp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Sun77789/webappsec-csp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Sun77789/webappsec-csp/teams","hooks_url":"https://api.github.com/repos/Sun77789/webappsec-csp/hooks","issue_events_url":"https://api.github.com/repos/Sun77789/webappsec-csp/issues/events{/number}","events_url":"https://api.github.com/repos/Sun77789/webappsec-csp/events","assignees_url":"https://api.github.com/repos/Sun77789/webappsec-csp/assignees{/user}","branches_url":"https://api.github.com/repos/Sun77789/webappsec-csp/branches{/branch}","tags_url":"https://api.github.com/repos/Sun77789/webappsec-csp/tags","blobs_url":"https://api.github.com/repos/Sun77789/webappsec-csp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Sun77789/webappsec-csp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Sun77789/webappsec-csp/git/refs{/sha}","trees_url":"https://api.github.com/repos/Sun77789/webappsec-csp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Sun77789/webappsec-csp/statuses/{sha}","languages_url":"https://api.github.com/repos/Sun77789/webappsec-csp/languages","stargazers_url":"https://api.github.com/repos/Sun77789/webappsec-csp/stargazers","contributors_url":"https://api.github.com/repos/Sun77789/webappsec-csp/contributors","subscribers_url":"https://api.github.com/repos/Sun77789/webappsec-csp/subscribers","subscription_url":"https://api.github.com/repos/Sun77789/webappsec-csp/subscription","commits_url":"https://api.github.com/repos/Sun77789/webappsec-csp/commits{/sha}","git_commits_url":"https://api.github.com/repos/Sun77789/webappsec-csp/git/commits{/sha}","comments_url":"https://api.github.com/repos/Sun77789/webappsec-csp/comments{/number}","issue_comment_url":"https://api.github.com/repos/Sun77789/webappsec-csp/issues/comments{/number}","contents_url":"https://api.github.com/repos/Sun77789/webappsec-csp/contents/{+path}","compare_url":"https://api.github.com/repos/Sun77789/webappsec-csp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Sun77789/webappsec-csp/merges","archive_url":"https://api.github.com/repos/Sun77789/webappsec-csp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Sun77789/webappsec-csp/downloads","issues_url":"https://api.github.com/repos/Sun77789/webappsec-csp/issues{/number}","pulls_url":"https://api.github.com/repos/Sun77789/webappsec-csp/pulls{/number}","milestones_url":"https://api.github.com/repos/Sun77789/webappsec-csp/milestones{/number}","notifications_url":"https://api.github.com/repos/Sun77789/webappsec-csp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Sun77789/webappsec-csp/labels{/name}","releases_url":"https://api.github.com/repos/Sun77789/webappsec-csp/releases{/id}","deployments_url":"https://api.github.com/repos/Sun77789/webappsec-csp/deployments","created_at":"2016-10-28T09:43:48Z","updated_at":"2016-10-28T09:43:49Z","pushed_at":"2016-12-08T18:33:22Z","git_url":"git://github.com/Sun77789/webappsec-csp.git","ssh_url":"git@github.com:Sun77789/webappsec-csp.git","clone_url":"https://github.com/Sun77789/webappsec-csp.git","svn_url":"https://github.com/Sun77789/webappsec-csp","homepage":"https://w3c.github.io/webappsec-csp/","size":2912,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"w3c:master","ref":"master","sha":"d1bface060cee258a8eaceb7fc2a12e897c3a727","user":{"login":"w3c","id":379216,"avatar_url":"https://avatars.githubusercontent.com/u/379216?v=3","gravatar_id":"","url":"https://api.github.com/users/w3c","html_url":"https://github.com/w3c","followers_url":"https://api.github.com/users/w3c/followers","following_url":"https://api.github.com/users/w3c/following{/other_user}","gists_url":"https://api.github.com/users/w3c/gists{/gist_id}","starred_url":"https://api.github.com/users/w3c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w3c/subscriptions","organizations_url":"https://api.github.com/users/w3c/orgs","repos_url":"https://api.github.com/users/w3c/repos","events_url":"https://api.github.com/users/w3c/events{/privacy}","received_events_url":"https://api.github.com/users/w3c/received_events","type":"Organization","site_admin":false},"repo":{"id":43490815,"name":"webappsec-csp","full_name":"w3c/webappsec-csp","owner":{"login":"w3c","id":379216,"avatar_url":"https://avatars.githubusercontent.com/u/379216?v=3","gravatar_id":"","url":"https://api.github.com/users/w3c","html_url":"https://github.com/w3c","followers_url":"https://api.github.com/users/w3c/followers","following_url":"https://api.github.com/users/w3c/following{/other_user}","gists_url":"https://api.github.com/users/w3c/gists{/gist_id}","starred_url":"https://api.github.com/users/w3c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w3c/subscriptions","organizations_url":"https://api.github.com/users/w3c/orgs","repos_url":"https://api.github.com/users/w3c/repos","events_url":"https://api.github.com/users/w3c/events{/privacy}","received_events_url":"https://api.github.com/users/w3c/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/w3c/webappsec-csp","description":"WebAppSec Content Security Policy","fork":false,"url":"https://api.github.com/repos/w3c/webappsec-csp","forks_url":"https://api.github.com/repos/w3c/webappsec-csp/forks","keys_url":"https://api.github.com/repos/w3c/webappsec-csp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/w3c/webappsec-csp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/w3c/webappsec-csp/teams","hooks_url":"https://api.github.com/repos/w3c/webappsec-csp/hooks","issue_events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/events{/number}","events_url":"https://api.github.com/repos/w3c/webappsec-csp/events","assignees_url":"https://api.github.com/repos/w3c/webappsec-csp/assignees{/user}","branches_url":"https://api.github.com/repos/w3c/webappsec-csp/branches{/branch}","tags_url":"https://api.github.com/repos/w3c/webappsec-csp/tags","blobs_url":"https://api.github.com/repos/w3c/webappsec-csp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/w3c/webappsec-csp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/w3c/webappsec-csp/git/refs{/sha}","trees_url":"https://api.github.com/repos/w3c/webappsec-csp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/w3c/webappsec-csp/statuses/{sha}","languages_url":"https://api.github.com/repos/w3c/webappsec-csp/languages","stargazers_url":"https://api.github.com/repos/w3c/webappsec-csp/stargazers","contributors_url":"https://api.github.com/repos/w3c/webappsec-csp/contributors","subscribers_url":"https://api.github.com/repos/w3c/webappsec-csp/subscribers","subscription_url":"https://api.github.com/repos/w3c/webappsec-csp/subscription","commits_url":"https://api.github.com/repos/w3c/webappsec-csp/commits{/sha}","git_commits_url":"https://api.github.com/repos/w3c/webappsec-csp/git/commits{/sha}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/comments{/number}","issue_comment_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments{/number}","contents_url":"https://api.github.com/repos/w3c/webappsec-csp/contents/{+path}","compare_url":"https://api.github.com/repos/w3c/webappsec-csp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/w3c/webappsec-csp/merges","archive_url":"https://api.github.com/repos/w3c/webappsec-csp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/w3c/webappsec-csp/downloads","issues_url":"https://api.github.com/repos/w3c/webappsec-csp/issues{/number}","pulls_url":"https://api.github.com/repos/w3c/webappsec-csp/pulls{/number}","milestones_url":"https://api.github.com/repos/w3c/webappsec-csp/milestones{/number}","notifications_url":"https://api.github.com/repos/w3c/webappsec-csp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/labels{/name}","releases_url":"https://api.github.com/repos/w3c/webappsec-csp/releases{/id}","deployments_url":"https://api.github.com/repos/w3c/webappsec-csp/deployments","created_at":"2015-10-01T10:33:26Z","updated_at":"2016-11-29T18:35:42Z","pushed_at":"2016-12-08T18:33:22Z","git_url":"git://github.com/w3c/webappsec-csp.git","ssh_url":"git@github.com:w3c/webappsec-csp.git","clone_url":"https://github.com/w3c/webappsec-csp.git","svn_url":"https://github.com/w3c/webappsec-csp","homepage":"https://w3c.github.io/webappsec-csp/","size":3189,"stargazers_count":26,"watchers_count":26,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":22,"mirror_url":null,"open_issues_count":74,"forks":22,"open_issues":74,"watchers":26,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165"},"html":{"href":"https://github.com/w3c/webappsec-csp/pull/165"},"issue":{"href":"https://api.github.com/repos/w3c/webappsec-csp/issues/165"},"comments":{"href":"https://api.github.com/repos/w3c/webappsec-csp/issues/165/comments"},"review_comments":{"href":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165/comments"},"review_comment":{"href":"https://api.github.com/repos/w3c/webappsec-csp/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/w3c/webappsec-csp/pulls/165/commits"},"statuses":{"href":"https://api.github.com/repos/w3c/webappsec-csp/statuses/031a6c97ff083ad04004d14f862699de891e41cc"}}}}
{"actor":{"display_login":"Sun77789"}}