CSP: `script-src-attr`, `script-src-elem`, `style-src-attr`, `style-src-elem` directives

These 4 new directives provide the functionality of the script/style directive but with more granularity, applying to elements or attributes.

Documentation

• https://w3c.github.io/webappsec-csp/#directive-script-src-attr
• https://w3c.github.io/webappsec-csp/#directive-script-src-elem
• https://w3c.github.io/webappsec-csp/#directive-style-src-attr
• https://w3c.github.io/webappsec-csp/#directive-style-src-elem

Specification

Editor's draft

Status in Chromium

Blink components: Blink>SecurityFeature>ContentSecurityPolicy

Enabled by default (tracking bug) in:

• Chrome for desktop release 75
• Chrome for Android release 75
• Android WebView release 75

Consensus & Standardization

• Firefox: Mixed public signals
• Edge: Mixed public signals
• Safari: Mixed public signals
• Web Developers: Positive

Owner

• andypaicu@chromium.org

Intent to Implement url

Last updated on 2019-03-18