contentsecuritypolicy2.json 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361
  1. {
  2. "title":"Content Security Policy Level 2",
  3. "description":"Mitigate cross-site scripting attacks by whitelisting allowed sources of script, style, and other resources. CSP 2 adds hash-source, nonce-source, and five new directives",
  4. "spec":"https://www.w3.org/TR/CSP2/",
  5. "status":"cr",
  6. "links":[
  7. {
  8. "url":"https://www.html5rocks.com/en/tutorials/security/content-security-policy/",
  9. "title":"HTML5Rocks article"
  10. },
  11. {
  12. "url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",
  13. "title":"MDN Web Docs - Content Security Policy"
  14. }
  15. ],
  16. "bugs":[
  17. {
  18. "description":"Partial support in Edge refers to [broken nonce suport](https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/13246371/) which will lead to breakages since sourced script tags with a valid nonce will get blocked."
  19. }
  20. ],
  21. "categories":[
  22. "Security"
  23. ],
  24. "stats":{
  25. "ie":{
  26. "5.5":"n",
  27. "6":"n",
  28. "7":"n",
  29. "8":"n",
  30. "9":"n",
  31. "10":"n",
  32. "11":"n"
  33. },
  34. "edge":{
  35. "12":"n",
  36. "13":"n",
  37. "14":"n",
  38. "15":"a #9",
  39. "16":"a #9",
  40. "17":"a #9",
  41. "18":"a #9"
  42. },
  43. "firefox":{
  44. "2":"n",
  45. "3":"n",
  46. "3.5":"n",
  47. "3.6":"n",
  48. "4":"n",
  49. "5":"n",
  50. "6":"n",
  51. "7":"n",
  52. "8":"n",
  53. "9":"n",
  54. "10":"n",
  55. "11":"n",
  56. "12":"n",
  57. "13":"n",
  58. "14":"n",
  59. "15":"n",
  60. "16":"n",
  61. "17":"n",
  62. "18":"n",
  63. "19":"n",
  64. "20":"n",
  65. "21":"n",
  66. "22":"n",
  67. "23":"n",
  68. "24":"n",
  69. "25":"n",
  70. "26":"n",
  71. "27":"n",
  72. "28":"n",
  73. "29":"n",
  74. "30":"n",
  75. "31":"a #1",
  76. "32":"a #1",
  77. "33":"a #1",
  78. "34":"a #1",
  79. "35":"a #2",
  80. "36":"a #3",
  81. "37":"a #3",
  82. "38":"a #3",
  83. "39":"a #3",
  84. "40":"a #3",
  85. "41":"a #3",
  86. "42":"a #3",
  87. "43":"a #3",
  88. "44":"a #3",
  89. "45":"a #7",
  90. "46":"a #7",
  91. "47":"a #7",
  92. "48":"a #7",
  93. "49":"a #7",
  94. "50":"a #7",
  95. "51":"a #7",
  96. "52":"a #7",
  97. "53":"a #7",
  98. "54":"a #7",
  99. "55":"a #7",
  100. "56":"a #7",
  101. "57":"a #7",
  102. "58":"a #7",
  103. "59":"a #7",
  104. "60":"a #7",
  105. "61":"a #7",
  106. "62":"a #7",
  107. "63":"a #7",
  108. "64":"a #7",
  109. "65":"a #7",
  110. "66":"a #7",
  111. "67":"a #7",
  112. "68":"a #7"
  113. },
  114. "chrome":{
  115. "4":"n",
  116. "5":"n",
  117. "6":"n",
  118. "7":"n",
  119. "8":"n",
  120. "9":"n",
  121. "10":"n",
  122. "11":"n",
  123. "12":"n",
  124. "13":"n",
  125. "14":"n",
  126. "15":"n",
  127. "16":"n",
  128. "17":"n",
  129. "18":"n",
  130. "19":"n",
  131. "20":"n",
  132. "21":"n",
  133. "22":"n",
  134. "23":"n",
  135. "24":"n",
  136. "25":"n",
  137. "26":"n",
  138. "27":"n",
  139. "28":"n",
  140. "29":"n",
  141. "30":"n",
  142. "31":"n",
  143. "32":"n",
  144. "33":"n",
  145. "34":"n",
  146. "35":"n",
  147. "36":"a #4",
  148. "37":"a #4",
  149. "38":"a #4",
  150. "39":"a #5",
  151. "40":"y",
  152. "41":"y",
  153. "42":"y",
  154. "43":"y",
  155. "44":"y",
  156. "45":"y",
  157. "46":"y",
  158. "47":"y",
  159. "48":"y",
  160. "49":"y",
  161. "50":"y",
  162. "51":"y",
  163. "52":"y",
  164. "53":"y",
  165. "54":"y",
  166. "55":"y",
  167. "56":"y",
  168. "57":"y",
  169. "58":"y",
  170. "59":"y",
  171. "60":"y",
  172. "61":"y",
  173. "62":"y",
  174. "63":"y",
  175. "64":"y",
  176. "65":"y",
  177. "66":"y",
  178. "67":"y",
  179. "68":"y",
  180. "69":"y",
  181. "70":"y",
  182. "71":"y",
  183. "72":"y",
  184. "73":"y",
  185. "74":"y",
  186. "75":"y",
  187. "76":"y"
  188. },
  189. "safari":{
  190. "3.1":"n",
  191. "3.2":"n",
  192. "4":"n",
  193. "5":"n",
  194. "5.1":"n",
  195. "6":"n",
  196. "6.1":"n",
  197. "7":"n",
  198. "7.1":"n",
  199. "8":"n",
  200. "9":"n",
  201. "9.1":"n",
  202. "10":"y",
  203. "10.1":"y",
  204. "11":"y",
  205. "11.1":"y",
  206. "12":"y",
  207. "12.1":"y",
  208. "TP":"y"
  209. },
  210. "opera":{
  211. "9":"n",
  212. "9.5-9.6":"n",
  213. "10.0-10.1":"n",
  214. "10.5":"n",
  215. "10.6":"n",
  216. "11":"n",
  217. "11.1":"n",
  218. "11.5":"n",
  219. "11.6":"n",
  220. "12":"n",
  221. "12.1":"n",
  222. "15":"n",
  223. "16":"n",
  224. "17":"n",
  225. "18":"n",
  226. "19":"n",
  227. "20":"n",
  228. "21":"n",
  229. "22":"n",
  230. "23":"a #4",
  231. "24":"a #4",
  232. "25":"a #4",
  233. "26":"a #5",
  234. "27":"y",
  235. "28":"y",
  236. "29":"y",
  237. "30":"y",
  238. "31":"y",
  239. "32":"y",
  240. "33":"y",
  241. "34":"y",
  242. "35":"y",
  243. "36":"y",
  244. "37":"y",
  245. "38":"y",
  246. "39":"y",
  247. "40":"y",
  248. "41":"y",
  249. "42":"y",
  250. "43":"y",
  251. "44":"y",
  252. "45":"y",
  253. "46":"y",
  254. "47":"y",
  255. "48":"y",
  256. "49":"y",
  257. "50":"y",
  258. "51":"y",
  259. "52":"y",
  260. "53":"y",
  261. "54":"y",
  262. "55":"y",
  263. "56":"y",
  264. "57":"y",
  265. "58":"y"
  266. },
  267. "ios_saf":{
  268. "3.2":"n",
  269. "4.0-4.1":"n",
  270. "4.2-4.3":"n",
  271. "5.0-5.1":"n",
  272. "6.0-6.1":"n",
  273. "7.0-7.1":"n",
  274. "8":"n",
  275. "8.1-8.4":"n",
  276. "9.0-9.2":"n",
  277. "9.3":"n",
  278. "10.0-10.2":"y",
  279. "10.3":"y",
  280. "11.0-11.2":"y",
  281. "11.3-11.4":"y",
  282. "12.0-12.1":"y",
  283. "12.2":"y"
  284. },
  285. "op_mini":{
  286. "all":"n"
  287. },
  288. "android":{
  289. "2.1":"n",
  290. "2.2":"n",
  291. "2.3":"n",
  292. "3":"n",
  293. "4":"n",
  294. "4.1":"n",
  295. "4.2-4.3":"n",
  296. "4.4":"n",
  297. "4.4.3-4.4.4":"n",
  298. "67":"y"
  299. },
  300. "bb":{
  301. "7":"n",
  302. "10":"n"
  303. },
  304. "op_mob":{
  305. "10":"n",
  306. "11":"n",
  307. "11.1":"n",
  308. "11.5":"n",
  309. "12":"n",
  310. "12.1":"n",
  311. "46":"y"
  312. },
  313. "and_chr":{
  314. "71":"y"
  315. },
  316. "and_ff":{
  317. "64":"a #6"
  318. },
  319. "ie_mob":{
  320. "10":"n",
  321. "11":"n"
  322. },
  323. "and_uc":{
  324. "11.8":"n"
  325. },
  326. "samsung":{
  327. "4":"y",
  328. "5.0-5.4":"y",
  329. "6.2-6.4":"y",
  330. "7.2-7.4":"y",
  331. "8.2":"y"
  332. },
  333. "and_qq":{
  334. "1.2":"y"
  335. },
  336. "baidu":{
  337. "7.12":"y"
  338. }
  339. },
  340. "notes":"",
  341. "notes_by_num":{
  342. "1":"Firefox 31-34 is missing the plugin-types, child-src, frame-ancestors, base-uri, and form-action directives.",
  343. "2":"Firefox 35 is missing the plugin-types, child-src, frame-ancestors, and form-action directives.",
  344. "3":"Firefox 36-44 is missing the plugin-types and child-src directives.",
  345. "4":"Chrome 36-38 & Opera 23-25 are missing the plugin-types, child-src, frame-ancestors, base-uri, and form-action directives.",
  346. "5":"Chrome 39 and Opera 26 are missing the plugin-types, child-src, base-uri, and form-action directives.",
  347. "6":"Firefox 38 on Android is missing the child-src directive.",
  348. "7":"Firefox 45+ is missing the plugin-types directive.",
  349. "9":"Edge has broken nonce support as it ignores nonces on sourced scripts."
  350. },
  351. "usage_perc_y":81.15,
  352. "usage_perc_a":6.44,
  353. "ucprefix":false,
  354. "parent":"",
  355. "keywords":"csp,header,nonce,hash",
  356. "ie_id":"contentsecuritypolicylevel2",
  357. "chrome_id":"4957003285790720",
  358. "firefox_id":"",
  359. "webkit_id":"specification-content-security-policy-level-2",
  360. "shown":true
  361. }