search

w3c / webappsec-csp

WebAppSec Content Security Policy
https://w3c.github.io/webappsec-csp/
Other
210 stars 78 forks source link

`report-sample` is not checked when firing "securitypolicyviolation" events #669

Closed mbrodesser-Igalia closed 5 months ago

mbrodesser-Igalia commented 5 months ago

See https://w3c.github.io/webappsec-csp/#changes-from-level-2 step 11 and https://w3c.github.io/webappsec-csp/#report-violation step 3.3.

Seems an oversight?

lukewarlow commented 5 months ago

It seems that it should be checked when setting the violation sample value rather than when it's used?

https://w3c.github.io/webappsec-csp/#should-block-inline - for example.