From 70e2a02f2787198da262ae5849493e9851a6d558 Mon Sep 17 00:00:00 2001
From: Mike West <mkwst@chromium.org>
Date: Wed, 8 Apr 2026 08:48:20 +0200
Subject: [PATCH] Update nonceable attribute checks for link elements

This PR adds `<link` to the blocklist for nonceable elements. If
we're going to keep this algorithm, it should cover all nonceable
elements, not just the script and style tags.
---
 index.bs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/index.bs b/index.bs
index 8877e9eea5..0bf7eef611 100644
--- a/index.bs
+++ b/index.bs
@@ -4343,10 +4343,12 @@ Content-Type: application/reports+json
       |element|'s <a for=Element>attribute list</a>:
 
       1.  If |attribute|'s name contains an <a>ASCII case-insensitive</a> match for
-          "<code>&lt;script</code>" or "<code>&lt;style</code>", return "`Not Nonceable`".
+          "<code>&lt;link</code>", "<code>&lt;script</code>", or "<code>&lt;style</code>",
+          return "`Not Nonceable`".
 
       2.  If |attribute|'s value contains an <a>ASCII case-insensitive</a> match for
-          "<code>&lt;script</code>" or "<code>&lt;style</code>", return "`Not Nonceable`".
+          "<code>&lt;link</code>", "<code>&lt;script</code>", or "<code>&lt;style</code>",
+          return "`Not Nonceable`".
 
   3.  If |element| had a [=duplicate-attribute=] [=parse error=] during tokenization, return
       "`Not Nonceable`".