update the usage of cryptographic nonce metadata #1177

siusin · 2018-02-02T04:41:08Z

To fix #198 :

update a few sections about the cryptographic nonce metadata;
add the integrity attribute;

chaals

Some editorial and linking changes, but the content looks OK to me.

chaals · 2018-02-02T10:20:58Z

single-page.bs

@@ -733,6 +734,11 @@ urlPrefix: https://tools.ietf.org/html/
    url: rfc7232#section-2.2; type: http-header; spec: rfc7232; text: last-modified
    url: rfc7234#section-5.2; type: http-header; spec: rfc7234; text: cache-control

+#  ************************** INFRA *************************************


this is unnecessary, bikeshed already has this reference. (Plus it is unnecessary as noted above)

chaals · 2018-02-02T10:29:24Z

sections/webappapis.include

+          <li>Let <var>base URL</var> be <var>initiating script</var>'s <a>base URL</a>.</li>
+
+          <li>
+          <p>Let <var>fetch options</var> be a <a>script fetch options</a> whose <a>cryptographic nonce</a> is <var>initiating script</var>'s <a>fetch options</a>'s


be a script settings options -> be a set of...

chaals · 2018-02-02T10:32:01Z

sections/webappapis.include


-  : A <dfn>parser state</dfn>
-  :: The <a>parser metadata</a> used to fetch imported modules.
+  : A <dfn>id</dfn>


A id -> An id

chaals · 2018-02-02T10:32:06Z

sections/webappapis.include

+  : A <a>target browsing context</a>
+  :: Null or a <a>service worker</a> that <a>controls</a> the <a>environment</a>.
+
+  : A <dfn>execution ready flag</dfn>


A execution -> An execution

chaals · 2018-02-02T10:32:48Z

sections/webappapis.include

-  : A <dfn>module record</dfn>
-  :: A <a>Source Text Module Record</a> representing the parsed module, ready to be evaluated.
+  : <dfn>Fetch options</dfn>
+  :: A <a>script fetch options</a>, containing various options related to fetching this


A script fetch options -> A set of...
or
-> A script fetch options object

chaals · 2018-02-02T10:34:32Z

sections/semantics-scriptings.include

       as "[=parser-inserted=]", and "`not parser-inserted`" otherwise.
-  17. Let <var>settings</var> be the element's <a>node document</a>'s {{Window}} object's
+  18. Let options be a <a>script fetch options</a> whose <a>cryptographic nonce metadata</a> is 


a script fetch options -> a set of script...
or -> a script fetch options object

chaals · 2018-02-02T10:35:45Z

sections/semantics-document-metadata.include

@@ -631,26 +631,28 @@
  must run the following steps:


-  1. If the <{link/href}> attribute's value is the empty string, then abort these steps.
+  1. If the <{link/href}> attribute's value is the empty string, then return.


note comment below on consistent terminology in algorithms.

No need to do anything here.

siusin · 2018-02-02T11:17:09Z

PR updated. Thanks for the review @chaals .

chaals

Thanks for the update.

Unfortunately there are a handful more editorial and nitpicky things - it seems I forgot to add many of my comments to the review before, and found some I had missed

Also, at https://w3c.github.io/html/dom.html#global-attributes the nonce attribute doesn't link to a definition, but it should...

chaals · 2018-02-02T12:53:07Z

sections/changes.include

@@ -24,6 +24,8 @@
            <dd>Substantive change. Fixed <a href="https://github.com/w3c/html/issues/1104">issue 1104</a></dd>
    <dt><a href="https://github.com/w3c/html/pull/1167">Added <{media/disableRemotePlayback}> to the {{HTMLMediaElement}} interface</a></dt>
            <dd>Fixed <a href="https://github.com/w3c/html/issues/1047">issue 1047</a></dd>
+    <dt><a href="https://github.com/w3c/html/pull/1177">Cleaned up the Fetch sections to apply the <a>cryptographic nonce metadata</a></a> </dt>
+            <dd>Fixed <a href="https://github.com/w3c/html/issues/198">issue 198</a></dd>


you also added SRI, right?

chaals · 2018-02-02T12:54:05Z

sections/semantics-document-metadata.include

@@ -631,26 +631,28 @@
  must run the following steps:


-  1. If the <{link/href}> attribute's value is the empty string, then abort these steps.
+  1. If the <{link/href}> attribute's value is the empty string, then return.


No need to do anything here.

chaals · 2018-02-02T12:58:27Z

sections/semantics-scriptings.include

@@ -431,11 +431,11 @@ o............A....e

      Otherwise, if the <{script}> element has a <{script/type}> attribute, let
      <var>the script block's type string</var> for this <{script}> element be the value of that
-      attribute with any leading or trailing sequences of [=space characters=] removed.
+      attribute with <a>strip leading and trailing ASCII whitespace</a>.


This line should read:

attribute after <a>stripping leading and trailing white space</a>.

to pick up the term defined in the spec.

chaals · 2018-02-02T13:01:41Z

sections/webappapis.include

+   initial fetch (for <a>module scripts</a>) and for fetching any
+   imported modules (for both <a>module scripts</a> and <a>classic scripts</a>)</p></dd>
+
+   <dt><dfnfor="script">referrer policy</dfn></dt>


dfn for (missing space)

chaals · 2018-02-02T13:02:47Z

sections/webappapis.include

+  <p>The <dfn>default classic script fetch options</dfn> are a set of<a>script fetch options</a>
+  whose <a>cryptographic nonce</a> is the empty
+  string, <a>integrity metadata</a> is the
+  empty string, <a>parser metadata</span> is "<code>not-parser-inserted</code>", <a>credentials mode</a> is "<code>omit</code>", and <a>referrer


please split the line differently so you don't have a line break inside the link <a>referrer policy</a>

chaals · 2018-02-02T13:08:54Z

sections/webappapis.include

+  <dl>
+   <dt><dfn>set up the classic script request</dfn></dt>
+   <dd><p>Set <var>request</var>'s <a>cryptographic nonce
+   metadata</a> to <var>options</var>'s <a>cryptographic nonce</a>, its <a>integrity metadata</a> to <var>options</var>'s


remove the final "s" at the end of the line - should read

...<var>options</var>'

chaals · 2018-02-02T13:09:09Z

sections/webappapis.include

+  empty string, <a>parser metadata</span> is "<code>not-parser-inserted</code>", <a>credentials mode</a> is "<code>omit</code>", and <a>referrer
+  policy</a> is the empty string.</p>
+
+  <p>Given a <a>request</a> <var>request</var> and a <a>script


line breaks

chaals · 2018-02-02T13:10:13Z

sections/webappapis.include

+  :: A <a>URL record</a> that represents the location of the resource with which the
+      <a>environment</a> is associated.
+      <p class="note">In the case of an <a>environment settings object</a>, this URL might be
+      distinct from the <a>environment settings object</a>'s <a>responsible


please don't split the link over 2 different lines

chaals · 2018-02-02T13:10:44Z

sections/webappapis.include

-  :: A flag which, if set, means that error information will not be provided for errors in this
-    script (used to mute errors for cross-origin scripts, since that can leak private information).
+  : A <dfn>record</dfn>
+  :: Either a <a>Script Record</a>, for <a>classic


please don't split the link over 2 different lines

chaals · 2018-02-02T13:14:13Z

sections/semantics-document-metadata.include

@@ -449,7 +449,7 @@
  The <dfn element-attr for="link"><code>media</code></dfn> attribute says which media the resource
  applies to. The value must be a <a>valid media query list</a>.

-  <!-- def <{link/integrity}> -->
+  The <dfn element-attr for="link"><code>integrity</code></dfn> attribute represents the <a>integrity metadata</a> for requests which this element is responsible for. The value is text. The attribute must not be specified on <{link}> elements that do not have a <{link/rel}> attribute that contains the <{link/stylesheet}> keyword. [[!SRI]]


please split this line for easier reading in tools that don't auto-wrap. E.g. < 100 characters / line ...

Fix linking error, note SRI was added.

…etadata (#1177)

update nonce usage in fetching resources

8752f9b

siusin requested review from chaals and cynthia February 2, 2018 04:41

update changes

88da74d

chaals suggested changes Feb 2, 2018

View reviewed changes

editorial fixes

78f1620

chaals suggested changes Feb 2, 2018

View reviewed changes

chaals added 4 commits February 4, 2018 22:36

Update changes

bd2ece7

Fix linking error, note SRI was added.

fix line breaking

2539f2e

fix link to term

34ed92b

Fix line breaks, editorial typos, ...

00c9a5d

chaals approved these changes Feb 4, 2018

View reviewed changes

update changes better

5db65d1

chaals merged commit baeec44 into w3c:master Feb 4, 2018

plehegar pushed a commit that referenced this pull request Feb 4, 2018

Built by Travis-CI: baeec44 update the usage of cryptographic nonce m…

363ee0c

…etadata (#1177)

siusin mentioned this pull request Feb 5, 2018

fix global attr link for nonce #1192

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update the usage of cryptographic nonce metadata #1177

update the usage of cryptographic nonce metadata #1177

siusin commented Feb 2, 2018

chaals left a comment

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

siusin commented Feb 2, 2018

chaals left a comment

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

chaals Feb 2, 2018

update the usage of cryptographic nonce metadata #1177

update the usage of cryptographic nonce metadata #1177

Conversation

siusin commented Feb 2, 2018

chaals left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

siusin commented Feb 2, 2018

chaals left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment