Fix violation's blockedURI for javascript navigations (#720)

SHA: f5d4027
Reason: push, by antosart

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: antosart

index.html

@@ -7,7 +7,7 @@
   <link href="https://www.w3.org/StyleSheets/TR/2021/W3C-WD" rel="stylesheet">
   <meta content="Bikeshed version b25686b9f, updated Fri Mar 14 14:15:20 2025 -0700" name="generator">
   <link href="https://www.w3.org/TR/CSP3/" rel="canonical">
-  <meta content="93e3f736cb565e24d06d6d2439426831a17aca28" name="revision">
+  <meta content="f5d402719986a5def6d913589d92b95a2e608fa9" name="revision">
   <meta content="dark light" name="color-scheme">
   <link href="https://www.w3.org/StyleSheets/TR/2021/dark.css" media="(prefers-color-scheme: dark)" rel="stylesheet" type="text/css">
 <style>
@@ -2014,8 +2014,7 @@ <h4 class="heading settled dfn-paneled algorithm" data-algorithm="Should element
            <li data-md>
             <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§ 2.4.1 Create a violation object for global, policy, and directive</a> on <var>navigation request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client" id="ref-for-concept-request-client③">client</a>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global" id="ref-for-concept-settings-object-global③">global object</a>, <var>policy</var>, and <var>directive-name</var>.</p>
            <li data-md>
-            <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource⑦">resource</a> to <var>navigation
-  request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url③">URL</a>.</p>
+            <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource⑦">resource</a> to "<code>inline</code>".</p>
            <li data-md>
             <p>Execute <a href="#report-violation">§ 5.5 Report a violation</a> on <var>violation</var>.</p>
            <li data-md>
@@ -2074,7 +2073,7 @@ <h4 class="heading settled dfn-paneled algorithm" data-algorithm="Should element
           <p>Otherwise, let <var>violation</var> be the result of executing <a href="#create-violation-for-global">§ 2.4.1 Create a violation object for global, policy, and directive</a> on <var>navigation request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client" id="ref-for-concept-request-client④">client</a>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global" id="ref-for-concept-settings-object-global④">global object</a>, <var>policy</var>, and <var>directive</var>’s <a data-link-type="dfn" href="#directive-name" id="ref-for-directive-name⑤">name</a>.</p>
          <li data-md>
           <p>Set <var>violation</var>’s <a data-link-type="dfn" href="#violation-resource" id="ref-for-violation-resource⑨">resource</a> to <var>navigation
-  request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url④">URL</a>.</p>
+  request</var>’s <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url③">URL</a>.</p>
          <li data-md>
           <p>Execute <a href="#report-violation">§ 5.5 Report a violation</a> on <var>violation</var>.</p>
          <li data-md>
@@ -2558,7 +2557,7 @@ <h3 class="heading settled algorithm" data-algorithm="Report a violation" data-l
              <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-method" id="ref-for-concept-request-method">method</a>
              <dd data-md>
               <p>"<code>POST</code>"</p>
-             <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url⑤">url</a>
+             <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url④">url</a>
              <dd data-md>
               <p><var>violation</var>’s <a data-link-type="dfn" href="#violation-url" id="ref-for-violation-url③">url</a></p>
              <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin">origin</a>
@@ -6404,7 +6403,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "d8b963e8": {"dfnID":"d8b963e8","dfnText":"isomorphic decode","external":true,"refSections":[{"refs":[{"id":"ref-for-isomorphic-decode"}],"title":"2.2.1. \n    Parse a serialized CSP\n  "}],"url":"https://infra.spec.whatwg.org/#isomorphic-decode"},
 "d8fc72f5": {"dfnID":"d8fc72f5","dfnText":"script-like","external":true,"refSections":[{"refs":[{"id":"ref-for-request-destination-script-like"},{"id":"ref-for-request-destination-script-like\u2460"}],"title":"5. \n    Reporting\n  "},{"refs":[{"id":"ref-for-request-destination-script-like\u2461"}],"title":"6.1.10. script-src"},{"refs":[{"id":"ref-for-request-destination-script-like\u2462"}],"title":"6.7.1.1. \n    Script directives pre-request check\n  "},{"refs":[{"id":"ref-for-request-destination-script-like\u2463"}],"title":"6.7.1.2. \n    Script directives post-request check\n  "}],"url":"https://fetch.spec.whatwg.org/#request-destination-script-like"},
 "da63e480": {"dfnID":"da63e480","dfnText":"sandboxed origin browsing context flag","external":true,"refSections":[{"refs":[{"id":"ref-for-sandboxed-origin-browsing-context-flag"}],"title":"6.3.2.1. \n    sandbox Initialization\n  "}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#sandboxed-origin-browsing-context-flag"},
-"dc1cd39b": {"dfnID":"dc1cd39b","dfnText":"URL (for request)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-url"},{"id":"ref-for-concept-request-url\u2460"}],"title":"2.4.2. \n    Create a violation object for request, and policy.\n  "},{"refs":[{"id":"ref-for-concept-request-url\u2461"},{"id":"ref-for-concept-request-url\u2462"}],"title":"4.2.4. \n    Should navigation request of type be blocked\n    by Content Security Policy?\n  "},{"refs":[{"id":"ref-for-concept-request-url\u2463"}],"title":"4.2.5. \n    Should navigation response to navigation request of type\n    in target be blocked by Content Security Policy?\n  "},{"refs":[{"id":"ref-for-concept-request-url\u2464"}],"title":"5.5. \n    Report a violation\n  "}],"url":"https://fetch.spec.whatwg.org/#concept-request-url"},
+"dc1cd39b": {"dfnID":"dc1cd39b","dfnText":"URL (for request)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-url"},{"id":"ref-for-concept-request-url\u2460"}],"title":"2.4.2. \n    Create a violation object for request, and policy.\n  "},{"refs":[{"id":"ref-for-concept-request-url\u2461"}],"title":"4.2.4. \n    Should navigation request of type be blocked\n    by Content Security Policy?\n  "},{"refs":[{"id":"ref-for-concept-request-url\u2462"}],"title":"4.2.5. \n    Should navigation response to navigation request of type\n    in target be blocked by Content Security Policy?\n  "},{"refs":[{"id":"ref-for-concept-request-url\u2463"}],"title":"5.5. \n    Report a violation\n  "}],"url":"https://fetch.spec.whatwg.org/#concept-request-url"},
 "dcffbccd": {"dfnID":"dcffbccd","dfnText":"URL","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url"},{"id":"ref-for-concept-url\u2460"}],"title":"5.2. \n    Obtain the blockedURI of a violation\u2019s resource\n  "},{"refs":[{"id":"ref-for-concept-url\u2461"}],"title":"5.4. Strip URL for use in reports"},{"refs":[{"id":"ref-for-concept-url\u2462"}],"title":"6.7.2.11. \n    port-part matching\n  "}],"url":"https://url.spec.whatwg.org/#concept-url"},
 "default-src": {"dfnID":"default-src","dfnText":"default-src","external":false,"refSections":[{"refs":[{"id":"ref-for-default-src"}],"title":"6. \n    Content Security Policy Directives\n  "},{"refs":[{"id":"ref-for-default-src\u2460"},{"id":"ref-for-default-src\u2461"},{"id":"ref-for-default-src\u2462"},{"id":"ref-for-default-src\u2463"}],"title":"6.1.3. default-src"},{"refs":[{"id":"ref-for-default-src\u2464"}],"title":"8.2. \n    Usage of \"'strict-dynamic'\"\n  "},{"refs":[{"id":"ref-for-default-src\u2465"},{"id":"ref-for-default-src\u2466"}],"title":"8.6. \n      Exfiltration\n    "},{"refs":[{"id":"ref-for-default-src\u2467"}],"title":"10.1. \n    Directive Registry\n  "}],"url":"#default-src"},
 "dictdef-securitypolicyviolationeventinit": {"dfnID":"dictdef-securitypolicyviolationeventinit","dfnText":"SecurityPolicyViolationEventInit","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-securitypolicyviolationeventinit"}],"title":"5.1. \n    Violation DOM Events\n  "}],"url":"#dictdef-securitypolicyviolationeventinit"},