← back to v141 · extend-csp-script-src-aka-script-src-v2
conformance · v141
v141 · extend-csp-script-src-aka-script-src-v2 — conformance probe
6 assertions drawn from the spec. Each is a single contract the spec text makes. Pass/fail reflects what this browser executed; blocked means the contract was not run because it needs user mediation, hardware, or another unavailable precondition. Open the page in Chrome stable / canary / Firefox / Safari to compare.
0
pass
0
fail
0
blocked
6
total
| id | contract | kind | verdict | detail |
|---|---|---|---|---|
trustedtypes-policyfactory |
TrustedTypePolicyFactory is exposed via window.trustedTypes, the surface CSP script-src builds on for typed sinks. | script | … | |
securitypolicyviolation-event |
SecurityPolicyViolationEvent is exposed, used to observe blocked scripts in the page. | exists | … | |
report-only-via-meta |
HTMLMetaElement.httpEquiv reflects the http-equiv attribute used for inline CSP, which carries script-src directives. | script | … | |
subtlecrypto-sha256-available |
crypto.subtle.digest is available; CSP script-src hashes are derived from SHA-256/384/512 of inline scripts. | script | … | |
eval-still-callable-by-default |
Without an active CSP, eval is callable; script-src-v2 introduces a hash-based mechanism specifically to control eval-like contents. | script | … | |
report-to-header-supported-via-reportingobserver |
ReportingObserver exists so CSP reports (the channel script-src violations flow through) can be observed. | exists | … |