Weekly github digest (WebAppSec specs)

Issues
------
* w3c/webappsec-csp (+0/-7/💬14)
  10 issues received 14 new comments:
  - #277 Allow CSP-Report-Only in meta tags. (4 by annevk, mikewest, dveditz)
    https://github.com/w3c/webappsec-csp/issues/277 
  - #348 Allow report-to in CSP and CSPRO meta tags (2 by ScottHelme, dveditz)
    https://github.com/w3c/webappsec-csp/issues/348 
  - #131 Embedded Enforcement: Invalid required csp attribute on iframe (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/131 [EMBEDDED] 
  - #225 Embedded: make clear that servers MUST respond with a CSP or Allow-CSP-From header, <meta> CSP's are not allowed. (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/225 [EMBEDDED] 
  - #44 Clarify what is the threat model for embedded enforcement (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/44 [EMBEDDED] 
  - #49 Embedded: consider other contexts other than iframe (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/49 [EMBEDDED] 
  - #115 Embedding-CSP header (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/115 [CSP] [EMBEDDED] 
  - #92 WebRTC RTCDataChannel can be used for exfiltration (1 by lgrahl)
    https://github.com/w3c/webappsec-csp/issues/92 
  - #126 Embedded: Think about the implications of allowing injected `csp` with reporting. (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/126 [EMBEDDED] 
  - #351 How is CSPEE recursive? (1 by mikewest)
    https://github.com/w3c/webappsec-csp/issues/351 

  7 issues closed:
  - Embedded: Think about the implications of allowing injected `csp` with reporting. https://github.com/w3c/webappsec-csp/issues/126 [EMBEDDED] 
  - Embedded Enforcement: Invalid required csp attribute on iframe https://github.com/w3c/webappsec-csp/issues/131 [EMBEDDED] 
  - Clarify what is the threat model for embedded enforcement https://github.com/w3c/webappsec-csp/issues/44 [EMBEDDED] 
  - Embedded: consider other contexts other than iframe https://github.com/w3c/webappsec-csp/issues/49 [EMBEDDED] 
  - Embedding-CSP header https://github.com/w3c/webappsec-csp/issues/115 [CSP] [EMBEDDED] 
  - Embedded: make clear that servers MUST respond with a CSP or Allow-CSP->From header, <meta> CSP's are not allowed. https://github.com/w3c/webappsec-csp/issues/225 [EMBEDDED] 
  - How is CSPEE recursive? https://github.com/w3c/webappsec-csp/issues/351 

* w3c/webappsec-credential-management (+0/-0/💬2)
  1 issues received 2 new comments:
  - #128 copy (aka snapshot) any buffersources in options before going async (2 by jcjones, mikewest)
    https://github.com/w3c/webappsec-credential-management/issues/128 

* w3c/permissions (+1/-2/💬2)
  1 issues created:
  - Allow Feature Policy-based permission models (by jan-ivar)
    https://github.com/w3c/permissions/issues/185 

  1 issues received 2 new comments:
  - #185 Allow Feature Policy-based permission models (2 by raymeskhoury, jan-ivar)
    https://github.com/w3c/permissions/issues/185 

  2 issues closed:
  - Allow Feature Policy-based permission models https://github.com/w3c/permissions/issues/185 
  - A new permission for screen-sharing with getDisplayMedia() https://github.com/w3c/permissions/issues/182 

* w3c/webappsec-referrer-policy (+1/-3/💬5)
  1 issues created:
  - How referrer policy deal with iframe srcdoc ? (by zxyxx)
    https://github.com/w3c/webappsec-referrer-policy/issues/116 

  5 issues received 5 new comments:
  - #112 add back "none" as legacy keyword (1 by mikewest)
    https://github.com/w3c/webappsec-referrer-policy/issues/112 
  - #116 How referrer policy deal with iframe srcdoc ? (1 by mikewest)
    https://github.com/w3c/webappsec-referrer-policy/issues/116 
  - #82 "TLS-protected" link seems not very useful (1 by mikewest)
    https://github.com/w3c/webappsec-referrer-policy/issues/82 
  - #108 Referrer policy of referencing in SVG? (1 by mikewest)
    https://github.com/w3c/webappsec-referrer-policy/issues/108 
  - #111 Should JavaScript module imports respect referrer policy, and if so, how? (1 by mikewest)
    https://github.com/w3c/webappsec-referrer-policy/issues/111 

  3 issues closed:
  - noreferrer isn't integrated with <link> https://github.com/w3c/webappsec-referrer-policy/issues/74 
  - "TLS-protected" link seems not very useful https://github.com/w3c/webappsec-referrer-policy/issues/82 
  - add back "none" as legacy keyword https://github.com/w3c/webappsec-referrer-policy/issues/112 

* w3c/webappsec-cspee (+7/-0/💬22)
  7 issues created:
  - Embedded: Think about the implications of allowing injected `csp` with reporting. (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/7 
  - Embedded Enforcement: Invalid required csp attribute on iframe (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/6 
  - Clarify what is the threat model for embedded enforcement (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/5 
  - Embedded: consider other contexts other than iframe (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/4 
  - Embedding-CSP header (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/3 
  - Embedded: make clear that servers MUST respond with a CSP or Allow-CSP->From header, <meta> CSP's are not allowed. (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/2 
  - How is CSPEE recursive? (by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/1 

  4 issues received 22 new comments:
  - #3 Embedding-CSP header (11 by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/3 [CSP] [EMBEDDED] 
  - #1 How is CSPEE recursive? (6 by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/1 
  - #4 Embedded: consider other contexts other than iframe (3 by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/4 [EMBEDDED] 
  - #2 Embedded: make clear that servers MUST respond with a CSP or Allow-CSP-From header, <meta> CSP's are not allowed. (2 by mikewest)
    https://github.com/w3c/webappsec-cspee/issues/2 [EMBEDDED] 



Pull requests
-------------
* w3c/webappsec-csp (+4/-1/💬3)
  4 pull requests submitted:
  - Added note in 'strict-dynamic' section to alert developers around potential avenues of attack (by andypaicu)
    https://github.com/w3c/webappsec-csp/pull/357 
  - Added more notes about nonce attacks (by andypaicu)
    https://github.com/w3c/webappsec-csp/pull/356 
  - Fixed various bikeshed linking warnings and removed embedded from mak… (by andypaicu)
    https://github.com/w3c/webappsec-csp/pull/355 
  - Fixed various bikeshed linking warnings and removed embedded from mak… (by andypaicu)
    https://github.com/w3c/webappsec-csp/pull/354 

  2 pull requests received 3 new comments:
  - #353 Changed names of some SPV event members (2 by andypaicu)
    https://github.com/w3c/webappsec-csp/pull/353 
  - #354 Fixed various bikeshed linking warnings and removed embedded from mak… (1 by andypaicu)
    https://github.com/w3c/webappsec-csp/pull/354 

  1 pull requests merged:
  - Fixed various bikeshed linking warnings and removed embedded from mak…
    https://github.com/w3c/webappsec-csp/pull/355 

* w3c/webappsec-credential-management (+0/-0/💬1)
  1 pull requests received 1 new comments:
  - #100 issue 92 accessing settings object: add passing global and queue task invoke callback (1 by equalsJeffH)
    https://github.com/w3c/webappsec-credential-management/pull/100 

* w3c/permissions (+0/-1/💬2)
  1 pull requests received 2 new comments:
  - #184 Add 'display' permission for screen-capture. (2 by mounirlamouri, jan-ivar)
    https://github.com/w3c/permissions/pull/184 

  1 pull requests merged:
  - Add 'display' permission for screen-capture.
    https://github.com/w3c/permissions/pull/184 


Repositories tracked by this digest:
-----------------------------------
* https://github.com/w3c/webappsec
* https://github.com/w3c/webappsec-subresource-integrity
* https://github.com/w3c/webappsec-csp
* https://github.com/w3c/webappsec-mixed-content
* https://github.com/w3c/webappsec-upgrade-insecure-requests
* https://github.com/w3c/webappsec-credential-management
* https://github.com/w3c/permissions
* https://github.com/w3c/webappsec-referrer-policy
* https://github.com/w3c/webappsec-secure-contexts
* https://github.com/w3c/webappsec-clear-site-data
* https://github.com/w3c/webappsec-cowl
* https://github.com/w3c/webappsec-epr
* https://github.com/w3c/webappsec-suborigins
* https://github.com/w3c/webappsec-cspee