{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/78","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/78/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/78/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/78/events","html_url":"https://github.com/w3c/webappsec-csp/issues/78","id":149827181,"number":78,"title":"Allow `hash-source` expressions match integrity metadata for external scripts.","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":14,"created_at":"2016-04-20T16:56:47Z","updated_at":"2016-11-10T06:06:06Z","closed_at":null,"body":"Currently, `script-src 'sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng='` matches `<script>alert('Hello, world.');</script>`. It does not match `alert('Hello, world.');` in a non-inlined script.\n\nI'd suggest that we alter this behavior to allow matching external scripts which assert integrity metadata about the resource requested. That is, the above directive could match:\n\n``` html\n<script src=\"/hello.js\"\n        integrity=\"qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng=\"\n        crossorigin=\"anonymous\">\n```\n\nAs discussed on the 20.4.2016 call, this could allow some interesting loader functionality in combination with `'unsafe-dynamic'`.\n\n/cc @hillbrad @dveditz \n\n(Note: Specifying this cleanly depends a bit on https://github.com/w3c/webappsec-subresource-integrity/issues/31.)\n"},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/259609098","html_url":"https://github.com/w3c/webappsec-csp/issues/78#issuecomment-259609098","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/78","id":259609098,"user":{"login":"devd","id":136985,"avatar_url":"https://avatars.githubusercontent.com/u/136985?v=3","gravatar_id":"","url":"https://api.github.com/users/devd","html_url":"https://github.com/devd","followers_url":"https://api.github.com/users/devd/followers","following_url":"https://api.github.com/users/devd/following{/other_user}","gists_url":"https://api.github.com/users/devd/gists{/gist_id}","starred_url":"https://api.github.com/users/devd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devd/subscriptions","organizations_url":"https://api.github.com/users/devd/orgs","repos_url":"https://api.github.com/users/devd/repos","events_url":"https://api.github.com/users/devd/events{/privacy}","received_events_url":"https://api.github.com/users/devd/received_events","type":"User","site_admin":false},"created_at":"2016-11-10T06:06:06Z","updated_at":"2016-11-10T06:06:06Z","body":"yeah looks good."}}
{"actor":{"display_login":"devd"}}