diff --git a/files/en-us/web/api/cspviolationreportbody/blockedurl/index.md b/files/en-us/web/api/cspviolationreportbody/blockedurl/index.md index 1eb23a50bfe096c..4bf3b49ccc5bade 100644 --- a/files/en-us/web/api/cspviolationreportbody/blockedurl/index.md +++ b/files/en-us/web/api/cspviolationreportbody/blockedurl/index.md @@ -8,23 +8,23 @@ browser-compat: api.CSPViolationReportBody.blockedURL {{APIRef("Reporting API")}} -The **`blockedURL`** read-only property of the {{domxref("CSPViolationReportBody")}} interface is a string value or URL that represents the resource that was blocked because it violates a [Content Security Policy (CSP)](/en-US/docs/Web/HTTP/CSP). +The **`blockedURL`** read-only property of the {{domxref("CSPViolationReportBody")}} interface is a string value that represents the resource that was blocked because it violates a [Content Security Policy (CSP)](/en-US/docs/Web/HTTP/CSP). ## Value An string containing a value or URL that represents the resource that violated the policy. -If the value is not an URL of a resource, it must be one of the following strings: +If the value is not the URL of a resource, it must be one of the following strings: - `inline` - - : An unsafe inline resource. + - : An inline resource. For example, an inline script that was used when [`'unsafe-inline'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) was not specified in the CSP. - `eval` - - : An unsafe `eval()`. - For example, `eval` was used but [`'unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-eval) was not specified in the CSP. + - : An `eval()`. + For example, `eval()` was used but [`'unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-eval) was not specified in the CSP. - `wasm-eval` - - : An unsafe WASM evaluation. - For example, `eval` was used but [`'wasm-unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#wasm-unsafe-eval) was not specified in the CSP. + - : An WASM evaluation. + For example, `eval()` was used but [`'wasm-unsafe-eval'`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#wasm-unsafe-eval) was not specified in the CSP. - `trusted-types-policy` - : A resource that violated the [`trusted-types`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/trusted-types) CSP directive. For example, a {{domxref("TrustedTypePolicy")}} was created using {{domxref("TrustedTypePolicyFactory/createPolicy", "window.trustedTypes.createPolicy()")}} with a name that wasn't listed in the `trusted-types` directive, or the new policy did not provide adequate sanitization. @@ -34,7 +34,7 @@ If the value is not an URL of a resource, it must be one of the following string ## Examples -The following examples show HTML that would result some of the `blockedURL` values outlined above. +The following examples show HTML that would result in some of the `blockedURL` values outlined above. The examples assume that you have a JavaScript file named `main.js` imported into your script from the same domain. The script, which is shown below, creates a new {{domxref("ReportingObserver")}} to observe content violation reports of type `"csp-violation"`. diff --git a/files/en-us/web/api/cspviolationreportbody/columnnumber/index.md b/files/en-us/web/api/cspviolationreportbody/columnnumber/index.md index 7a90f0f7c076bb0..b982d835ce5843c 100644 --- a/files/en-us/web/api/cspviolationreportbody/columnnumber/index.md +++ b/files/en-us/web/api/cspviolationreportbody/columnnumber/index.md @@ -28,7 +28,7 @@ This example triggers a CSP violation using an inline script, and reports the vi #### HTML -The HTML file below uses the [``](/en-US/docs/Web/HTML/Element/meta) element to set the {{httpheader('Content-Security-Policy')}} `default-src` to `self`, which allows scripts and other resources to be loaded from the same domain, but does not allow inline scripts to be executed. +The HTML file below uses the [``](/en-US/docs/Web/HTML/Element/meta) element to set the {{httpheader('Content-Security-Policy')}} `default-src` to `self`, which allows scripts and other resources to be loaded from the same origin, but does not allow inline scripts to be executed. The document also includes an inline script, which should therefore trigger a CSP violation. ```html diff --git a/files/en-us/web/api/cspviolationreportbody/documenturl/index.md b/files/en-us/web/api/cspviolationreportbody/documenturl/index.md index 702dba536330c06..298e2c87221bbf1 100644 --- a/files/en-us/web/api/cspviolationreportbody/documenturl/index.md +++ b/files/en-us/web/api/cspviolationreportbody/documenturl/index.md @@ -24,7 +24,7 @@ We navigate to the page from another page and log the `referrer`, `documentURL`, #### HTML First we define our referrer page `/bounce/index.html`. -This is a very simple HTML page that has a link to another file `../report_sample/index.html`. +This page just contains a link to another page `../report_sample/index.html`. ```html @@ -100,7 +100,7 @@ referrer: http://127.0.0.1:9999/bounce/ blockedURL: inline ``` -Note that `referrer` is the page we navigated form, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an unsafe inline script. +Note that `referrer` is the page we navigated from, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an inline script. ## Specifications diff --git a/files/en-us/web/api/cspviolationreportbody/referrer/index.md b/files/en-us/web/api/cspviolationreportbody/referrer/index.md index da1352244cc9757..f04a3924e4680bd 100644 --- a/files/en-us/web/api/cspviolationreportbody/referrer/index.md +++ b/files/en-us/web/api/cspviolationreportbody/referrer/index.md @@ -16,8 +16,8 @@ The referrer is the page that caused the page with the CSP violation to be loade A string representing the URL for the referrer of the page with the CSP violation, or null. -Note that if the referrer is an HTTP URL then any username, password or fragment is removed. -If the URL scheme is not `http:` then just the scheme is returned. +Note that if the referrer is an HTTP(S) URL then any username, password or fragment is removed. +If the URL scheme is not `http:` or `https:` then just the scheme is returned. ## Examples @@ -29,7 +29,7 @@ We navigate to the page from another page and log the `referrer`, `documentURL`, #### HTML First we define our referrer page `/bounce/index.html`. -This is a very simple HTML page that has a link to another file `../report_sample/index.html`. +This page just contains a link to another page `../report_sample/index.html`. ```html @@ -105,7 +105,7 @@ referrer: http://127.0.0.1:9999/bounce/ blockedURL: inline ``` -Note that `referrer` is the page we navigated form, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an unsafe inline script. +Note that `referrer` is the page we navigated from, `documentURL` is the page with the CSP violation, and `blockedURL` is not an URL at all in this case, but an indication that the violation was caused by an unsafe inline script. ## Specifications