Skip to content

Commit

Permalink
Apply suggestions from code review - the easy ones
Browse files Browse the repository at this point in the history
Co-authored-by: wbamberg <[email protected]>
  • Loading branch information
hamishwillee and wbamberg committed Sep 20, 2024
1 parent 84a7b2c commit 339657c
Show file tree
Hide file tree
Showing 4 changed files with 15 additions and 15 deletions.
16 changes: 8 additions & 8 deletions files/en-us/web/api/cspviolationreportbody/blockedurl/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,23 +8,23 @@ browser-compat: api.CSPViolationReportBody.blockedURL

{{APIRef("Reporting API")}}

The **`blockedURL`** read-only property of the {{domxref("CSPViolationReportBody")}} interface is a string value or URL that represents the resource that was blocked because it violates a [Content Security Policy (CSP)](/en-US/docs/Web/HTTP/CSP).
The **`blockedURL`** read-only property of the {{domxref("CSPViolationReportBody")}} interface is a string value that represents the resource that was blocked because it violates a [Content Security Policy (CSP)](/en-US/docs/Web/HTTP/CSP).

## Value

An string containing a value or URL that represents the resource that violated the policy.

If the value is not an URL of a resource, it must be one of the following strings:
If the value is not the URL of a resource, it must be one of the following strings:

- `inline`
- : An unsafe inline resource.
- : An inline resource.
For example, an inline script that was used when [`'unsafe-inline'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) was not specified in the CSP.
- `eval`
- : An unsafe `eval()`.
For example, `eval` was used but [`'unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-eval) was not specified in the CSP.
- : An `eval()`.
For example, `eval()` was used but [`'unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-eval) was not specified in the CSP.
- `wasm-eval`
- : An unsafe WASM evaluation.
For example, `eval` was used but [`'wasm-unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#wasm-unsafe-eval) was not specified in the CSP.
- : An WASM evaluation.
For example, `eval()` was used but [`'wasm-unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#wasm-unsafe-eval) was not specified in the CSP.
- `trusted-types-policy`
- : A resource that violated the [`trusted-types`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/trusted-types) CSP directive.
For example, a {{domxref("TrustedTypePolicy")}} was created using {{domxref("TrustedTypePolicyFactory/createPolicy", "window.trustedTypes.createPolicy()")}} with a name that wasn't listed in the `trusted-types` directive, or the new policy did not provide adequate sanitization.
Expand All @@ -34,7 +34,7 @@ If the value is not an URL of a resource, it must be one of the following string

## Examples

The following examples show HTML that would result some of the `blockedURL` values outlined above.
The following examples show HTML that would result in some of the `blockedURL` values outlined above.

The examples assume that you have a JavaScript file named `main.js` imported into your script from the same domain.
The script, which is shown below, creates a new {{domxref("ReportingObserver")}} to observe content violation reports of type `"csp-violation"`.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ This example triggers a CSP violation using an inline script, and reports the vi

#### HTML

The HTML file below uses the [`<meta>`](/en-US/docs/Web/HTML/Element/meta) element to set the {{httpheader('Content-Security-Policy')}} `default-src` to `self`, which allows scripts and other resources to be loaded from the same domain, but does not allow inline scripts to be executed.
The HTML file below uses the [`<meta>`](/en-US/docs/Web/HTML/Element/meta) element to set the {{httpheader('Content-Security-Policy')}} `default-src` to `self`, which allows scripts and other resources to be loaded from the same origin, but does not allow inline scripts to be executed.
The document also includes an inline script, which should therefore trigger a CSP violation.

```html
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ We navigate to the page from another page and log the `referrer`, `documentURL`,
#### HTML

First we define our referrer page `/bounce/index.html`.
This is a very simple HTML page that has a link to another file `../report_sample/index.html`.
This page just contains a link to another page `../report_sample/index.html`.

```html
<!doctype html>
Expand Down Expand Up @@ -100,7 +100,7 @@ referrer: http://127.0.0.1:9999/bounce/
blockedURL: inline
```

Note that `referrer` is the page we navigated form, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an unsafe inline script.
Note that `referrer` is the page we navigated from, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an inline script.

## Specifications

Expand Down
8 changes: 4 additions & 4 deletions files/en-us/web/api/cspviolationreportbody/referrer/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ The referrer is the page that caused the page with the CSP violation to be loade

A string representing the URL for the referrer of the page with the CSP violation, or null.

Note that if the referrer is an HTTP URL then any username, password or fragment is removed.
If the URL scheme is not `http:` then just the scheme is returned.
Note that if the referrer is an HTTP(S) URL then any username, password or fragment is removed.
If the URL scheme is not `http:` or `https:` then just the scheme is returned.

## Examples

Expand All @@ -29,7 +29,7 @@ We navigate to the page from another page and log the `referrer`, `documentURL`,
#### HTML

First we define our referrer page `/bounce/index.html`.
This is a very simple HTML page that has a link to another file `../report_sample/index.html`.
This page just contains a link to another page `../report_sample/index.html`.

```html
<!doctype html>
Expand Down Expand Up @@ -105,7 +105,7 @@ referrer: http://127.0.0.1:9999/bounce/
blockedURL: inline
```

Note that `referrer` is the page we navigated form, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an unsafe inline script.
Note that `referrer` is the page we navigated from, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an unsafe inline script.

## Specifications

Expand Down

0 comments on commit 339657c

Please sign in to comment.