search

w3c / webappsec-csp

WebAppSec Content Security Policy
https://w3c.github.io/webappsec-csp/
Other
207 stars 78 forks source link

`report-sample` is not checked when firing "securitypolicyviolation" events #669

Closed mbrodesser-Igalia closed 3 months ago

mbrodesser-Igalia commented 3 months ago

See https://w3c.github.io/webappsec-csp/#changes-from-level-2 step 11 and https://w3c.github.io/webappsec-csp/#report-violation step 3.3.

Seems an oversight?

lukewarlow commented 3 months ago

It seems that it should be checked when setting the violation sample value rather than when it's used?

https://w3c.github.io/webappsec-csp/#should-block-inline - for example.