diff --git a/index.bs b/index.bs index 9349d0aa2c..d7ba126a56 100644 --- a/index.bs +++ b/index.bs @@ -3800,6 +3800,11 @@ Content-Type: application/reports+json Given a request |request|, a response |response|, a directive |directive|, and a policy |policy|: + Note: This check needs both |request| and |response| as input + parameters since if |request|'s cryptographic nonce metadata + or integrity metadata matches, then the script is allowed to load + and the check of whether |response|'s url matches the source list is skipped. + 1. If |request|'s destination is script-like: 1. Call [=potentially report hash=] with |response|, |request|, |directive| and |policy|. @@ -3814,13 +3819,17 @@ Content-Type: application/reports+json for="request">integrity metadata and this directive's value is "`Matches`", return "`Allowed`". - 1. If |directive|'s value contains - "`'strict-dynamic'`": + 1. If |directive|'s value contains a source + expression that is an ASCII case-insensitive match for + the "`'strict-dynamic'`" keyword-source: - 1. If |request|'s parser metadata is not - "parser-inserted", return "`Allowed`". + 1. If the |request|'s parser metadata is + "parser-inserted", return "`Blocked`". - Otherwise, return "`Blocked`". + Otherwise, return "`Allowed`". + + Note: "`'strict-dynamic'`" is explained in more detail + in [[#strict-dynamic-usage]]. 1. If the result of executing [[#match-response-to-source-list]] on |response|, |request|, |directive|'s value,