From 60f9094177a4a17366b2c15cecf33eafcd2fa65e Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Mon, 9 Sep 2024 16:02:58 +0100 Subject: [PATCH] Remove CSP dynamic code compilation block This has been upstreamed to the CSP spec. --- spec/index.bs | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/spec/index.bs b/spec/index.bs index 25236f9..64acfbd 100644 --- a/spec/index.bs +++ b/spec/index.bs @@ -748,9 +748,9 @@ anElement.innerHTML = trustedTypes.emptyHTML; // no need to create a policy : emptyScript :: is a {{TrustedScript}} object with its [=TrustedScript/data=] value set to an empty string. -Note: This object can be used to detect if the runtime environment has [[#csp-eval]]. While native Trusted Types implementation can -support `eval(TrustedScript)`, it is impossible for a polyfill to emulate that, as -eval(TrustedScript) will return its input without unwrapping and evaluating the code. +Note: This object can be used to detect if the runtime environment has support for dynamic code compilation. +While native Trusted Types implementation can support `eval(TrustedScript)`, it is impossible for a polyfill to +emulate that, as eval(TrustedScript) will return its input without unwrapping and evaluating the code.
@@ -1483,10 +1483,6 @@ strings (|createdPolicyNames|), this algorithm returns `"Blocked"` if the `"Blocked"`. 1. Return |result|. -### Support for dynamic code compilation ### {#csp-eval} - -Note: See [https://github.com/w3c/webappsec-csp/pull/659](https://github.com/w3c/webappsec-csp/pull/659) which upstreams this integration. - # Security Considerations # {#security-considerations} Trusted Types are not intended to protect access to [=injection sinks=] in an