@@ -1405,16 +1405,18 @@ spec: WebAssembly-web-api-api; urlPrefix: https://webassembly.github.io/spec/web
1405
1405
to determine whether such compilation ought to be blocked.
1406
1406
1407
1407
<h4 id="can-compile-strings" algorithm dfn export>
1408
- EnsureCSPDoesNotBlockStringCompilation(|callerRealm|, |calleeRealm |, |source|)
1408
+ EnsureCSPDoesNotBlockStringCompilation(|realm |, |source|)
1409
1409
</h4>
1410
1410
1411
- Given two <a>realms </a> (<var ignore> callerRealm </var> and |calleeRealm |),
1412
- and a string (|source|), this algorithm returns normally if string compilation
1413
- is allowed, and throws an "`EvalError`" if not:
1411
+ Given a <a>realm </a> (|realm|) and a string (|source |), this algorithm
1412
+ returns normally if string compilation is allowed, and throws an "`EvalError`"
1413
+ if not:
1414
1414
1415
1415
1. Let |result| be "`Allowed`".
1416
1416
1417
- 2. For each |policy| in |calleeRealm|'s [=global object/CSP list=] :
1417
+ 2. Let |global| be |realm|'s [=Realm/global object=] .
1418
+
1419
+ 3. For each |policy| in |global|'s [=global object/CSP list=] :
1418
1420
1419
1421
1. Let |source-list| be `null`.
1420
1422
@@ -1429,7 +1431,7 @@ spec: WebAssembly-web-api-api; urlPrefix: https://webassembly.github.io/spec/web
1429
1431
then:
1430
1432
1431
1433
1. Let |violation| be the result of executing [[#create-violation-for-global]] on
1432
- |calleeRealm |, |policy|, and "`script-src`".
1434
+ |global |, |policy|, and "`script-src`".
1433
1435
1434
1436
2. Set |violation|'s [=violation/resource=] to "`eval`".
1435
1437
@@ -1442,15 +1444,12 @@ spec: WebAssembly-web-api-api; urlPrefix: https://webassembly.github.io/spec/web
1442
1444
5. If |policy|'s [=policy/disposition=] is "`enforce`", then set |result| to
1443
1445
"`Blocked`".
1444
1446
1445
- 3 . If |result| is "`Blocked`", throw an `EvalError` exception.
1447
+ 4 . If |result| is "`Blocked`", throw an `EvalError` exception.
1446
1448
1447
1449
ISSUE(tc39/ecma262#938): {{HostEnsureCanCompileStrings()}} does not include the string which is
1448
1450
going to be compiled as a parameter. We'll also need to update HTML to pipe that value through
1449
1451
to CSP.
1450
1452
1451
- Note: The parameter |callerRealm| is ignored on purpose, see
1452
- <a href="https://github.com/w3c/webappsec-csp/issues/438">Issue 438</a> .
1453
-
1454
1453
<h3 id="wasm-integration">Integration with WebAssembly</h3>
1455
1454
1456
1455
WebAssembly defines the {{HostEnsureCanCompileWasmBytes()}} abstract operation
0 commit comments