Skip to content

Commit 60f9094

Browse files
committed
Remove CSP dynamic code compilation block
This has been upstreamed to the CSP spec.
1 parent cf78f7e commit 60f9094

File tree

1 file changed

+3
-7
lines changed

1 file changed

+3
-7
lines changed

spec/index.bs

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -748,9 +748,9 @@ anElement.innerHTML = trustedTypes.emptyHTML; // no need to create a policy
748748
: <dfn>emptyScript</dfn>
749749
:: is a {{TrustedScript}} object with its [=TrustedScript/data=] value set to an empty string.
750750

751-
Note: This object can be used to detect if the runtime environment has [[#csp-eval]]. While native Trusted Types implementation can
752-
support `eval(TrustedScript)`, it is impossible for a polyfill to emulate that, as
753-
eval(TrustedScript) will return its input without unwrapping and evaluating the code.
751+
Note: This object can be used to detect if the runtime environment has support for dynamic code compilation.
752+
While native Trusted Types implementation can support `eval(TrustedScript)`, it is impossible for a polyfill to
753+
emulate that, as eval(TrustedScript) will return its input without unwrapping and evaluating the code.
754754

755755
<div class="example" id="empty-script-example">
756756
<xmp highlight="js">
@@ -1483,10 +1483,6 @@ strings (|createdPolicyNames|), this algorithm returns `"Blocked"` if the
14831483
`"Blocked"`.
14841484
1. Return |result|.
14851485

1486-
### Support for dynamic code compilation ### {#csp-eval}
1487-
1488-
Note: See [https://github.com/w3c/webappsec-csp/pull/659](https://github.com/w3c/webappsec-csp/pull/659) which upstreams this integration.
1489-
14901486
# Security Considerations # {#security-considerations}
14911487

14921488
Trusted Types are not intended to protect access to [=injection sinks=] in an

0 commit comments

Comments
 (0)