{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec/issues/481","labels_url":"https://api.github.com/repos/w3c/webappsec/issues/481/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec/issues/481/comments","events_url":"https://api.github.com/repos/w3c/webappsec/issues/481/events","html_url":"https://github.com/w3c/webappsec/issues/481","id":107759189,"number":481,"title":"CSP2: copy/paste bug in `default-src` definition.","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/w3c/webappsec/labels/CSP","name":"CSP","color":"207de5"}],"state":"open","locked":false,"assignee":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/w3c/webappsec/milestones/2","html_url":"https://github.com/w3c/webappsec/milestones/CSP%202","labels_url":"https://api.github.com/repos/w3c/webappsec/milestones/2/labels","id":756947,"number":2,"title":"CSP 2","description":"","creator":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":8,"state":"open","created_at":"2014-08-18T07:34:09Z","updated_at":"2015-09-22T17:13:41Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-09-22T17:13:40Z","updated_at":"2015-09-24T08:04:20Z","closed_at":null,"body":"> Let the default sources be the result of parsing the default-src directive’s value as a source list if a default-src directive is explicitly specified, and otherwise the U+002A ASTERISK character (*).\r\n\r\nThis is a copy/paste error on my part. A missing `default-src` should have no effect; as written, it would block inline script and eval."},"comment":{"url":"https://api.github.com/repos/w3c/webappsec/issues/comments/142846535","html_url":"https://github.com/w3c/webappsec/issues/481#issuecomment-142846535","issue_url":"https://api.github.com/repos/w3c/webappsec/issues/481","id":142846535,"user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"created_at":"2015-09-24T08:04:20Z","updated_at":"2015-09-24T08:04:20Z","body":"Actually, looking at this again, I don't think it has any impact. We're not \"enforcing\" the `default-src` directive if it's not present in the list of directives, so the value doesn't matter at all. Specifying that it's the `*` character makes no sense, but it's not actively harmful."}}