diff --git a/index.bs b/index.bs index b84d46a98b..35fedc4cbd 100644 --- a/index.bs +++ b/index.bs @@ -471,18 +471,21 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ Parse a serialized CSP - To parse a serialized CSP, given a [=string=] |serialized|, a - [=policy/source=] |source|, and a [=policy/disposition=] |disposition|, execute the - following steps. + To parse a serialized CSP, given a [=byte sequence=] or + [=string=] |serialized|, a [=policy/source=] |source|, and a [=policy/disposition=] + |disposition|, execute the following steps. This algorithm returns a [=Content Security Policy object=]. If |serialized| could not be parsed, the object's [=policy/directive set=] will be empty.
    - 1. Let |policy| be a new [=/policy=] with an empty [=policy/directive set=], a [=policy/source=] + 1. If |serialized| is a [=byte sequence=], then set |serialized| to be the result of + [=isomorphic decoding=] |serialized|. + + 2. Let |policy| be a new [=/policy=] with an empty [=policy/directive set=], a [=policy/source=] of |source|, and a [=policy/disposition=] of |disposition|. - 2. For each |token| returned by [=strictly split a string|strictly splitting=] |serialized| on + 3. For each |token| returned by [=strictly split a string|strictly splitting=] |serialized| on the U+003B SEMICOLON character (`;`): 1. [=Strip leading and trailing ASCII whitespace=] from |token|. @@ -513,64 +516,46 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ 8. [=set/append|Append=] |directive| to |policy|'s [=policy/directive set=]. - 3. Return |policy|. + 4. Return |policy|.
-

- Parse a serialized CSP list +

+ Parse |response|'s Content Security Policies

- To parse a serialized CSP list, given a [=byte sequence=] or [=string=] - |list|, a [=policy/source=] |source|, and a [=policy/disposition=] |disposition|, execute - the following steps. + To parse a response's Content Security Policies given a response + |response|, execute the following steps. - This algorithm returns a [=list=] of [=Content Security Policy objects=]. If |list| cannot be - parsed, the returned list will be empty. + This algorithm returns a [=list=] of [=Content Security Policy objects=]. If the policies cannot + be parsed, the returned list will be empty.
    - 1. If |list| is a [=byte sequence=], then set |list| to be the result of isomorphic decoding |list|. - - 2. Let |policies| be an empty [=list=]. + 1. Let |policies| be an empty [=list=]. - 3. [=list/For each=] |token| returned by splitting |list| on commas: + 2. For each |token| returned by [=extracting header list values=] given + `Content-Security-Policy` and |response|'s [=response/header list=]: - 1. Let |policy| be the result of parsing - |token|, with a [=policy/source=] of |source|, and [=policy/disposition=] of - |disposition|. + 1. Let |policy| be the result of + parsing |token|, with a + [=policy/source=] of "`header`", and a [=policy/disposition=] of "`enforce`". - 2. If |policy|'s [=policy/directive set=] is empty, [=iteration/continue=]. + 2. If |policy|'s [=policy/directive set=] is not empty, append |policy| to |policies|. - 3. [=list/append|Append=] |policy| to |policies|. + 3. For each |token| returned by [=extracting header list values=] given + `Content-Security-Policy-Report-Only` and |response|'s [=response/header list=]: - 4. Return |policies|. -
- -

- Parse |response|'s Content Security Policies -

- - To parse a response's Content Security Policies given a response - |response|: - -
    - 1. Let |policies| be the result of parsing - the result of [=extracting header list values=] given `Content-Security-Policy` and - |response|'s [=response/header list=], with a [=policy/source=] of "`header`", and a - [=policy/disposition=] of "`enforce`". + 1. Let |policy| be the result of + parsing |token|, with a + [=policy/source=] of "`header`", and a [=policy/disposition=] of "`report`". - 2. Append to |policies| the result of - parsing the result of - [=extracting header list values=] given `Content-Security-Policy-Report-Only` and - |response|'s [=response/header list=], with a [=policy/source=] of "`header`", and a - [=policy/disposition=] of "`report`". + 2. If |policy|'s [=policy/directive set=] is not empty, append |policy| to |policies|. - 3. For each |policy| of |policies|: + 4. For each |policy| of |policies|: 1. Set |policy|'s [=policy/self-origin=] to |response|'s [=response/url=]'s [=url/origin=]. - 4. Return |policies|. + 5. Return |policies|.
Note: When parsing a response's