{"action":"created","comment":{"url":"https://api.github.com/repos/whatwg/html/pulls/comments/47425082","id":47425082,"diff_hunk":"@@ -10881,6 +10881,12 @@ Transport Protocol\">HTTP&lt;/abbr> today.&lt;/p></pre> <!-- DO NOT REWRAP THIS L\n   according to the rules given for <span data-x=\"CSS styling attribute\">CSS styling\n   attributes</span>. <ref spec=CSSATTR></p>\n \n+  <p>However, if the <span>Should element's inline behavior be blocked by Content Security\n+  Policy?</span> algorithm returns \"<code data-x=\"\">Blocked</code>\" when executed upon the\n+  attribute's <span>element</span> and \"<code data-x=\"\">style attribute</code>\", then the style","path":"source","position":6,"original_position":6,"commit_id":"49b162fd0c31169ff2e6940961fa7b94c3233d1f","original_commit_id":"49b162fd0c31169ff2e6940961fa7b94c3233d1f","user":{"login":"domenic","id":617481,"avatar_url":"https://avatars.githubusercontent.com/u/617481?v=3","gravatar_id":"","url":"https://api.github.com/users/domenic","html_url":"https://github.com/domenic","followers_url":"https://api.github.com/users/domenic/followers","following_url":"https://api.github.com/users/domenic/following{/other_user}","gists_url":"https://api.github.com/users/domenic/gists{/gist_id}","starred_url":"https://api.github.com/users/domenic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenic/subscriptions","organizations_url":"https://api.github.com/users/domenic/orgs","repos_url":"https://api.github.com/users/domenic/repos","events_url":"https://api.github.com/users/domenic/events{/privacy}","received_events_url":"https://api.github.com/users/domenic/received_events","type":"User","site_admin":false},"body":"https://w3c.github.io/webappsec-csp/#should-block-inline says \"`\"style-src\"` if type is `\"style\"` and `\"script-src\"` otherwise,\" so `\"style attribute\"` will use `\"script-src\"`, I believe.\r\n\r\nIn general, is there value in differentiating between \"script\" and \"script attribute\" and the same for style?","created_at":"2015-12-12T02:06:57Z","updated_at":"2015-12-12T02:06:57Z","html_url":"https://github.com/whatwg/html/pull/384#discussion_r47425082","pull_request_url":"https://api.github.com/repos/whatwg/html/pulls/384","_links":{"self":{"href":"https://api.github.com/repos/whatwg/html/pulls/comments/47425082"},"html":{"href":"https://github.com/whatwg/html/pull/384#discussion_r47425082"},"pull_request":{"href":"https://api.github.com/repos/whatwg/html/pulls/384"}}},"pull_request":{"url":"https://api.github.com/repos/whatwg/html/pulls/384","id":52677661,"html_url":"https://github.com/whatwg/html/pull/384","diff_url":"https://github.com/whatwg/html/pull/384.diff","patch_url":"https://github.com/whatwg/html/pull/384.patch","issue_url":"https://api.github.com/repos/whatwg/html/issues/384","number":384,"state":"open","locked":false,"title":"CSP: Add hooks to handle inline events and style","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"body":"The \"Should element's inline behavior be blocked by CSP?\" algorithm now\r\naccepts a \"type\", and can handle event handlers and style attributes.\r\nThis patch adds the relevant hooks to the handling of those two\r\nfeatures, and updates the existing hooks for inline `<script>` and\r\n`<style>` elements themselves.","created_at":"2015-12-04T14:51:06Z","updated_at":"2015-12-12T02:06:58Z","closed_at":null,"merged_at":null,"merge_commit_sha":"312a62c5b28d140128cdfbf5a6cddac7f0a2d147","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/whatwg/html/pulls/384/commits","review_comments_url":"https://api.github.com/repos/whatwg/html/pulls/384/comments","review_comment_url":"https://api.github.com/repos/whatwg/html/pulls/comments{/number}","comments_url":"https://api.github.com/repos/whatwg/html/issues/384/comments","statuses_url":"https://api.github.com/repos/whatwg/html/statuses/49b162fd0c31169ff2e6940961fa7b94c3233d1f","head":{"label":"mikewest:hooks","ref":"hooks","sha":"49b162fd0c31169ff2e6940961fa7b94c3233d1f","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"repo":{"id":41528537,"name":"html","full_name":"mikewest/html","owner":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mikewest/html","description":"HTML Standard","fork":true,"url":"https://api.github.com/repos/mikewest/html","forks_url":"https://api.github.com/repos/mikewest/html/forks","keys_url":"https://api.github.com/repos/mikewest/html/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mikewest/html/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mikewest/html/teams","hooks_url":"https://api.github.com/repos/mikewest/html/hooks","issue_events_url":"https://api.github.com/repos/mikewest/html/issues/events{/number}","events_url":"https://api.github.com/repos/mikewest/html/events","assignees_url":"https://api.github.com/repos/mikewest/html/assignees{/user}","branches_url":"https://api.github.com/repos/mikewest/html/branches{/branch}","tags_url":"https://api.github.com/repos/mikewest/html/tags","blobs_url":"https://api.github.com/repos/mikewest/html/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mikewest/html/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mikewest/html/git/refs{/sha}","trees_url":"https://api.github.com/repos/mikewest/html/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mikewest/html/statuses/{sha}","languages_url":"https://api.github.com/repos/mikewest/html/languages","stargazers_url":"https://api.github.com/repos/mikewest/html/stargazers","contributors_url":"https://api.github.com/repos/mikewest/html/contributors","subscribers_url":"https://api.github.com/repos/mikewest/html/subscribers","subscription_url":"https://api.github.com/repos/mikewest/html/subscription","commits_url":"https://api.github.com/repos/mikewest/html/commits{/sha}","git_commits_url":"https://api.github.com/repos/mikewest/html/git/commits{/sha}","comments_url":"https://api.github.com/repos/mikewest/html/comments{/number}","issue_comment_url":"https://api.github.com/repos/mikewest/html/issues/comments{/number}","contents_url":"https://api.github.com/repos/mikewest/html/contents/{+path}","compare_url":"https://api.github.com/repos/mikewest/html/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mikewest/html/merges","archive_url":"https://api.github.com/repos/mikewest/html/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mikewest/html/downloads","issues_url":"https://api.github.com/repos/mikewest/html/issues{/number}","pulls_url":"https://api.github.com/repos/mikewest/html/pulls{/number}","milestones_url":"https://api.github.com/repos/mikewest/html/milestones{/number}","notifications_url":"https://api.github.com/repos/mikewest/html/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mikewest/html/labels{/name}","releases_url":"https://api.github.com/repos/mikewest/html/releases{/id}","created_at":"2015-08-28T05:15:38Z","updated_at":"2015-08-28T05:15:39Z","pushed_at":"2015-12-04T14:50:53Z","git_url":"git://github.com/mikewest/html.git","ssh_url":"git@github.com:mikewest/html.git","clone_url":"https://github.com/mikewest/html.git","svn_url":"https://github.com/mikewest/html","homepage":"https://html.spec.whatwg.org/multipage/","size":102589,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"whatwg:master","ref":"master","sha":"ec989ff6284b6aca8174a4fa00d03454787a5613","user":{"login":"whatwg","id":2226336,"avatar_url":"https://avatars.githubusercontent.com/u/2226336?v=3","gravatar_id":"","url":"https://api.github.com/users/whatwg","html_url":"https://github.com/whatwg","followers_url":"https://api.github.com/users/whatwg/followers","following_url":"https://api.github.com/users/whatwg/following{/other_user}","gists_url":"https://api.github.com/users/whatwg/gists{/gist_id}","starred_url":"https://api.github.com/users/whatwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whatwg/subscriptions","organizations_url":"https://api.github.com/users/whatwg/orgs","repos_url":"https://api.github.com/users/whatwg/repos","events_url":"https://api.github.com/users/whatwg/events{/privacy}","received_events_url":"https://api.github.com/users/whatwg/received_events","type":"Organization","site_admin":false},"repo":{"id":11969507,"name":"html","full_name":"whatwg/html","owner":{"login":"whatwg","id":2226336,"avatar_url":"https://avatars.githubusercontent.com/u/2226336?v=3","gravatar_id":"","url":"https://api.github.com/users/whatwg","html_url":"https://github.com/whatwg","followers_url":"https://api.github.com/users/whatwg/followers","following_url":"https://api.github.com/users/whatwg/following{/other_user}","gists_url":"https://api.github.com/users/whatwg/gists{/gist_id}","starred_url":"https://api.github.com/users/whatwg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whatwg/subscriptions","organizations_url":"https://api.github.com/users/whatwg/orgs","repos_url":"https://api.github.com/users/whatwg/repos","events_url":"https://api.github.com/users/whatwg/events{/privacy}","received_events_url":"https://api.github.com/users/whatwg/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/whatwg/html","description":"HTML Standard","fork":false,"url":"https://api.github.com/repos/whatwg/html","forks_url":"https://api.github.com/repos/whatwg/html/forks","keys_url":"https://api.github.com/repos/whatwg/html/keys{/key_id}","collaborators_url":"https://api.github.com/repos/whatwg/html/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/whatwg/html/teams","hooks_url":"https://api.github.com/repos/whatwg/html/hooks","issue_events_url":"https://api.github.com/repos/whatwg/html/issues/events{/number}","events_url":"https://api.github.com/repos/whatwg/html/events","assignees_url":"https://api.github.com/repos/whatwg/html/assignees{/user}","branches_url":"https://api.github.com/repos/whatwg/html/branches{/branch}","tags_url":"https://api.github.com/repos/whatwg/html/tags","blobs_url":"https://api.github.com/repos/whatwg/html/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/whatwg/html/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/whatwg/html/git/refs{/sha}","trees_url":"https://api.github.com/repos/whatwg/html/git/trees{/sha}","statuses_url":"https://api.github.com/repos/whatwg/html/statuses/{sha}","languages_url":"https://api.github.com/repos/whatwg/html/languages","stargazers_url":"https://api.github.com/repos/whatwg/html/stargazers","contributors_url":"https://api.github.com/repos/whatwg/html/contributors","subscribers_url":"https://api.github.com/repos/whatwg/html/subscribers","subscription_url":"https://api.github.com/repos/whatwg/html/subscription","commits_url":"https://api.github.com/repos/whatwg/html/commits{/sha}","git_commits_url":"https://api.github.com/repos/whatwg/html/git/commits{/sha}","comments_url":"https://api.github.com/repos/whatwg/html/comments{/number}","issue_comment_url":"https://api.github.com/repos/whatwg/html/issues/comments{/number}","contents_url":"https://api.github.com/repos/whatwg/html/contents/{+path}","compare_url":"https://api.github.com/repos/whatwg/html/compare/{base}...{head}","merges_url":"https://api.github.com/repos/whatwg/html/merges","archive_url":"https://api.github.com/repos/whatwg/html/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/whatwg/html/downloads","issues_url":"https://api.github.com/repos/whatwg/html/issues{/number}","pulls_url":"https://api.github.com/repos/whatwg/html/pulls{/number}","milestones_url":"https://api.github.com/repos/whatwg/html/milestones{/number}","notifications_url":"https://api.github.com/repos/whatwg/html/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/whatwg/html/labels{/name}","releases_url":"https://api.github.com/repos/whatwg/html/releases{/id}","created_at":"2013-08-08T06:26:07Z","updated_at":"2015-12-11T17:35:32Z","pushed_at":"2015-12-12T00:04:20Z","git_url":"git://github.com/whatwg/html.git","ssh_url":"git@github.com:whatwg/html.git","clone_url":"https://github.com/whatwg/html.git","svn_url":"https://github.com/whatwg/html","homepage":"https://html.spec.whatwg.org/multipage/","size":107441,"stargazers_count":283,"watchers_count":283,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":58,"mirror_url":null,"open_issues_count":126,"forks":58,"open_issues":126,"watchers":283,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/whatwg/html/pulls/384"},"html":{"href":"https://github.com/whatwg/html/pull/384"},"issue":{"href":"https://api.github.com/repos/whatwg/html/issues/384"},"comments":{"href":"https://api.github.com/repos/whatwg/html/issues/384/comments"},"review_comments":{"href":"https://api.github.com/repos/whatwg/html/pulls/384/comments"},"review_comment":{"href":"https://api.github.com/repos/whatwg/html/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/whatwg/html/pulls/384/commits"},"statuses":{"href":"https://api.github.com/repos/whatwg/html/statuses/49b162fd0c31169ff2e6940961fa7b94c3233d1f"}}}}