|  | 
| 170 | 170 |       "rationale": "let", | 
| 171 | 171 |       "steps": [ | 
| 172 | 172 |         { | 
| 173 |  | -          "html": "<p>Let <var>integrityPolicy</var> be a new <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy-struct\" id=\"ref-for-integrity-policy-struct\">integrity policy struct</a>.</p>" | 
|  | 173 | +          "html": "<p>Let <var>integrityPolicy</var> be a new <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy\" id=\"ref-for-integrity-policy\">integrity policy</a>.</p>" | 
| 174 | 174 |         }, | 
| 175 | 175 |         { | 
| 176 | 176 |           "html": "<p>Let <var>dictionary</var> be the result of <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-header-list-get-structured-header\" id=\"ref-for-concept-header-list-get-structured-header\">getting a structured field value</a> from <var>headers</var> given <var>headerName</var> and \"<code>dictionary</code>\".</p>" | 
|  | 
| 211 | 211 |           "html": "<p>Let <var>headers</var> be <var>response</var>’s <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-response-header-list\" id=\"ref-for-concept-response-header-list\">header list</a>.</p>" | 
| 212 | 212 |         }, | 
| 213 | 213 |         { | 
| 214 |  | -          "html": "<p>If <var>headers</var> <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-list-contains\" id=\"ref-for-header-list-contains\">contains</a> <code>integrity-policy</code>,\n set <var>container</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy\" id=\"ref-for-integrity-policy\">integrity policy</a> be the result of running <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#processing-an-integrity-policy\" id=\"ref-for-processing-an-integrity-policy\">processing an integrity policy</a> with the corresponding <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-value\" id=\"ref-for-header-value\">header value</a>.</p>" | 
|  | 214 | +          "html": "<p>If <var>headers</var> <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-list-contains\" id=\"ref-for-header-list-contains\">contains</a> <code>integrity-policy</code>,\n set <var>container</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#policy-container-integrity-policy\" id=\"ref-for-policy-container-integrity-policy\">integrity policy</a> be the result of running <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#processing-an-integrity-policy\" id=\"ref-for-processing-an-integrity-policy\">processing an integrity policy</a> with the corresponding <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-value\" id=\"ref-for-header-value\">header value</a>.</p>" | 
| 215 | 215 |         }, | 
| 216 | 216 |         { | 
| 217 |  | -          "html": "<p>If <var>headers</var> <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-list-contains\" id=\"ref-for-header-list-contains①\">contains</a> <code>integrity-policy-report-only</code>,\n set <var>container</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#report-only-integrity-policy\" id=\"ref-for-report-only-integrity-policy\">report only integrity policy</a> be the result of running <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#processing-an-integrity-policy\" id=\"ref-for-processing-an-integrity-policy①\">processing an integrity policy</a> with the corresponding <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-value\" id=\"ref-for-header-value①\">header value</a>.</p>" | 
|  | 217 | +          "html": "<p>If <var>headers</var> <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-list-contains\" id=\"ref-for-header-list-contains①\">contains</a> <code>integrity-policy-report-only</code>,\n set <var>container</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#policy-container-report-only-integrity-policy\" id=\"ref-for-policy-container-report-only-integrity-policy\">report only integrity policy</a> be the result of running <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#processing-an-integrity-policy\" id=\"ref-for-processing-an-integrity-policy①\">processing an integrity policy</a> with the corresponding <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#header-value\" id=\"ref-for-header-value①\">header value</a>.</p>" | 
| 218 | 218 |         } | 
| 219 | 219 |       ] | 
| 220 | 220 |     }, | 
|  | 
| 234 | 234 |           "html": "<p>If <var>parsedMetadata</var> is not the empty set and <var>request</var>’s <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-request-mode\" id=\"ref-for-concept-request-mode\">mode</a> is either \"<code>cors</code>\" or \"<code>same-origin</code>\",\n return \"Allowed\".</p>" | 
| 235 | 235 |         }, | 
| 236 | 236 |         { | 
| 237 |  | -          "html": "<p>Let <var>policy</var> be <var>policyContainer</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy\" id=\"ref-for-integrity-policy①\">integrity policy</a>.</p>" | 
|  | 237 | +          "html": "<p>Let <var>policy</var> be <var>policyContainer</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#policy-container-integrity-policy\" id=\"ref-for-policy-container-integrity-policy①\">integrity policy</a>.</p>" | 
| 238 | 238 |         }, | 
| 239 | 239 |         { | 
| 240 |  | -          "html": "<p>Let <var>reportPolicy</var> be <var>policyContainer</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#report-only-integrity-policy\" id=\"ref-for-report-only-integrity-policy①\">report only integrity policy</a>.</p>" | 
|  | 240 | +          "html": "<p>Let <var>reportPolicy</var> be <var>policyContainer</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#policy-container-report-only-integrity-policy\" id=\"ref-for-policy-container-report-only-integrity-policy①\">report only integrity policy</a>.</p>" | 
| 241 | 241 |         }, | 
| 242 | 242 |         { | 
| 243 |  | -          "html": "<p>If both <var>policy</var> and <var>reportPolicy</var> are empty <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy-struct\" id=\"ref-for-integrity-policy-struct①\">integrity policy struct</a>s, return \"Allowed\".</p>" | 
|  | 243 | +          "html": "<p>If both <var>policy</var> and <var>reportPolicy</var> are empty <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy\" id=\"ref-for-integrity-policy①\">integrity policy</a>s, return \"Allowed\".</p>" | 
| 244 | 244 |         }, | 
| 245 | 245 |         { | 
| 246 | 246 |           "html": "<p>Let <var>global</var> be <var>request</var>’s <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-request-client\" id=\"ref-for-concept-request-client\">client</a>’s <a data-link-type=\"dfn\" href=\"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global\" id=\"ref-for-concept-settings-object-global\">global object</a>.</p>" | 
|  | 
| 271 | 271 |     { | 
| 272 | 272 |       "name": "report violation", | 
| 273 | 273 |       "href": "https://w3c.github.io/webappsec-subresource-integrity/#report-violation", | 
| 274 |  | -      "html": "To <dfn class=\"dfn-paneled has-dfn-panel\" data-dfn-type=\"dfn\" data-noexport=\"\" id=\"report-violation\" role=\"button\" aria-expanded=\"false\" tabindex=\"0\">report violation</dfn> given a <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-request\" id=\"ref-for-concept-request②\">Request</a> <var>request</var>, a boolean <var>block</var>,\n  a boolean <var>reportBlock</var>, an <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy-struct\" id=\"ref-for-integrity-policy-struct②\">integrity policy struct</a> <var>policy</var>,\n  and an <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy-struct\" id=\"ref-for-integrity-policy-struct③\">integrity policy struct</a> <var>reportPolicy</var>, do the following:", | 
|  | 274 | +      "html": "To <dfn class=\"dfn-paneled has-dfn-panel\" data-dfn-type=\"dfn\" data-noexport=\"\" id=\"report-violation\" role=\"button\" aria-expanded=\"false\" tabindex=\"0\">report violation</dfn> given a <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-request\" id=\"ref-for-concept-request②\">Request</a> <var>request</var>, a boolean <var>block</var>,\n  a boolean <var>reportBlock</var>, an <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy\" id=\"ref-for-integrity-policy②\">integrity policy</a> <var>policy</var>,\n  and an <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy\" id=\"ref-for-integrity-policy③\">integrity policy</a> <var>reportPolicy</var>, do the following:", | 
| 275 | 275 |       "rationale": "assert", | 
| 276 | 276 |       "steps": [ | 
| 277 | 277 |         { | 
|  | 
| 299 | 299 |           "html": "<p><a data-link-type=\"dfn\" href=\"https://infra.spec.whatwg.org/#assert\" id=\"ref-for-assert②\">Assert</a>: <var>url</var> is a <a data-link-type=\"dfn\" href=\"https://url.spec.whatwg.org/#concept-url\" id=\"ref-for-concept-url\">URL</a>.</p>" | 
| 300 | 300 |         }, | 
| 301 | 301 |         { | 
| 302 |  | -          "html": "<p>Let <var>documentURL</var> be the result of <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/CSP3/#strip-url-for-use-in-reports\" id=\"ref-for-strip-url-for-use-in-reports\">strip URL for use in reports</a> on <var>url</var>.</p>" | 
|  | 302 | +          "html": "<p>Let <var>documentURL</var> be the result of <a data-link-type=\"dfn\" href=\"https://w3c.github.io/reporting/#strip-url-for-use-in-reports\" id=\"ref-for-strip-url-for-use-in-reports\">strip URL for use in reports</a> on <var>url</var>.</p>" | 
| 303 | 303 |         }, | 
| 304 | 304 |         { | 
| 305 |  | -          "html": "<p>Let <var>blockedURL</var> be the result of <a data-link-type=\"dfn\" href=\"https://www.w3.org/TR/CSP3/#strip-url-for-use-in-reports\" id=\"ref-for-strip-url-for-use-in-reports①\">strip URL for use in reports</a> on <var>request</var>’s <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-request-url\" id=\"ref-for-concept-request-url\">URL</a>.</p>" | 
|  | 305 | +          "html": "<p>Let <var>blockedURL</var> be the result of <a data-link-type=\"dfn\" href=\"https://w3c.github.io/reporting/#strip-url-for-use-in-reports\" id=\"ref-for-strip-url-for-use-in-reports①\">strip URL for use in reports</a> on <var>request</var>’s <a data-link-type=\"dfn\" href=\"https://fetch.spec.whatwg.org/#concept-request-url\" id=\"ref-for-concept-request-url\">URL</a>.</p>" | 
| 306 | 306 |         }, | 
| 307 | 307 |         { | 
| 308 | 308 |           "html": "If <var>block</var> is true, <a data-link-type=\"dfn\" href=\"https://infra.spec.whatwg.org/#list-iterate\" id=\"ref-for-list-iterate\">for each</a> <var>endpoint</var> in <var>policy</var>’s <a data-link-type=\"dfn\" href=\"https://w3c.github.io/webappsec-subresource-integrity/#endpoints\" id=\"ref-for-endpoints①\">endpoints</a>:", | 
|  | 
0 commit comments