--- a/user-interface-safety.html Mon Mar 25 14:04:44 2013 -0700
+++ b/user-interface-safety.html Mon Mar 25 15:42:01 2013 -0700
@@ -91,7 +91,7 @@
"CLEARCLICK" : "G. Maone <a href=\"http://noscript.net/downloads/ClearClick_WAS2012_rv2.pdf\"><cite>ClearClick: Effective Client-Side Protection Against UI Redressing Attacks</cite></a>. (Work in progress.) URL: <a href=\"http://noscript.net/downloads/ClearClick_WAS2012_rv2.pdf\">http://noscript.net/downloads/ClearClick_WAS2012_rv2.pdf</a>",
"UIREDRESS" : "M. Zalewski <a href=\"http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing)\"><cite>Browser Security Handbook, part 2</cite></a>. URL: <a href=\"http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing)\">http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing)</a>",
"FRAMEBUSTING" : "Boneh, et al. <a href=\"http://seclab.stanford.edu/websec/framebusting/\"><cite>Busting frame busting: a study of clickjacking vulnerabilities at popular sites</cite></a>. URL: <a href=\"http://seclab.stanford.edu/websec/framebusting/\">http://seclab.stanford.edu/websec/framebusting/</a>",
-"INCONTEXT" : "Lin-Shung Huang, et al. <a href=\"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final39.pdf\"><cite>Clickjacking:Attacks and Defenses</cite></a> published in the 21st USENIX Security Symposium Proceedings. URL: <a href=\"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final39.pdf\">https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final39.pdf</a>","SELECTORS4" : "Elika J. Etemad. <a href=\"http://www.w3.org/TR/2011/WD-selectors4-20110929/\"><cite>Selectors Level 4.</cite></a> 29 September 2011. W3C Working Draft. (Work in progress.) URL: <a href=\"http://www.w3.org/TR/2011/WD-selectors4-20110929/\">http://www.w3.org/TR/2011/WD-selectors4-20110929/</a>","POINTER-EVENTS" : "Jacob Rossi and Matt Brubeck. <a href=\"http://www.w3.org/TR/pointerevents/\"><cite>Pointer Events.</cite></a> 19 February 2013 W3C Working Draft. (Work in progress.) URL: <a href=\"http://www.w3.org/TR/pointerevents/\">http://www.w3.org/TR/pointerevents/</a>", "CAPTCHA-Wikipedia" : "Wikipedia <a href=\"http://en.wikipedia.org/wiki/CAPTCHA\"><cite>CAPTCHA</cite></a> from Wikipedia. URL: <a href=\"http://en.wikipedia.org/wiki/CAPTCHA\">http://en.wikipedia.org/wiki/CAPTCHA</a>", "CLICKJACKING-Unresolved" : "Lin-Shung Huang and Collin Jackson. <a href=\"https://docs.google.com/document/pub?id=1hVcxPeCidZrM5acFH9ZoTYzg1D0VjkG3BDW_oUdn5qc\"><cite>Clickjacking Attacks Unresolved.</cite></a> Carnegie Mellon University, 06 July 2011. URL: <a href=\"https://docs.google.com/document/pub?id=1hVcxPeCidZrM5acFH9ZoTYzg1D0VjkG3BDW_oUdn5qc\">https://docs.google.com/document/pub?id=1hVcxPeCidZrM5acFH9ZoTYzg1D0VjkG3BDW_oUdn5qc</a>"
+"INCONTEXT" : "Lin-Shung Huang, et al. <a href=\"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final39.pdf\"><cite>Clickjacking:Attacks and Defenses</cite></a> published in the 21st USENIX Security Symposium Proceedings. URL: <a href=\"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final39.pdf\">https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final39.pdf</a>","SELECTORS4" : "Elika J. Etemad. <a href=\"http://www.w3.org/TR/2011/WD-selectors4-20110929/\"><cite>Selectors Level 4.</cite></a> 29 September 2011. W3C Working Draft. (Work in progress.) URL: <a href=\"http://www.w3.org/TR/2011/WD-selectors4-20110929/\">http://www.w3.org/TR/2011/WD-selectors4-20110929/</a>","POINTER-EVENTS" : "Jacob Rossi and Matt Brubeck. <a href=\"http://www.w3.org/TR/pointerevents/\"><cite>Pointer Events.</cite></a> 19 February 2013 W3C Working Draft. (Work in progress.) URL: <a href=\"http://www.w3.org/TR/pointerevents/\">http://www.w3.org/TR/pointerevents/</a>", "CAPTCHA-Wikipedia" : "Wikipedia <a href=\"http://en.wikipedia.org/wiki/CAPTCHA\"><cite>CAPTCHA</cite></a> from Wikipedia. URL: <a href=\"http://en.wikipedia.org/wiki/CAPTCHA\">http://en.wikipedia.org/wiki/CAPTCHA</a>", "CLICKJACKING-Unresolved" : "Lin-Shung Huang and Collin Jackson. <a href=\"https://docs.google.com/document/pub?id=1hVcxPeCidZrM5acFH9ZoTYzg1D0VjkG3BDW_oUdn5qc\"><cite>Clickjacking Attacks Unresolved.</cite></a> Carnegie Mellon University, 06 July 2011. URL: <a href=\"https://docs.google.com/document/pub?id=1hVcxPeCidZrM5acFH9ZoTYzg1D0VjkG3BDW_oUdn5qc\">https://docs.google.com/document/pub?id=1hVcxPeCidZrM5acFH9ZoTYzg1D0VjkG3BDW_oUdn5qc</a>","CSP11" : "A. Barth, D. Veditz and M. West <a href=\"https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html\"><cite>Content Security Policy 1.1</cite></a>. W3C Editors' Draft. (Work in progress.) URL: <a href=\"https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html\">https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html</a>"
}
@@ -524,10 +524,9 @@
<p>This specification introduces a new attribute for the <code>UIEvent</code>
interface introduced in DOM Level 2. [[!DOM-LEVEL-2-EVENTS]]</p>
<section>
-<h3><code>unsafe</code> attribute for the <code>UIEvent</code> interface</h3>
-<dl>
- <dt><code>unsafe</code> of type <span class="idlMemberType">boolean</span>,
- readonly </dt>
+
+<dl title="partial interface UIEvent" class="idl">
+ <dt>readonly attribute bool unsafe</dt>
<dd>This is a non-configurable boolean property of input event objects. The
value <em class="rfc2119" title="should">should</em> be "true" if a
violation occurred. The value <em class="rfc2119"
@@ -556,13 +555,13 @@
<p class="issue" title="Pending CSP 1.1 Details">Is expressing these in terms of "partial" interfaces and dictionaries or as new types that extend the basic CSP 1.1 types the correct way to do this?</p>
-<p>If associated with a Content Security Policy 1.1 or later implementation, the User Interface Security Directives include
-the following script interfaces:</p>
+<p>If associated with a Content Security Policy 1.1 [[CSP11]] or later implementation, the User Interface Security Directives include
+the following script interfaces which extend the experimental functinality defined therein: <a href="https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-interfaces--experimental">https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-interfaces--experimental</a></p>
<section>
<h4><code>SecurityPolicyViolationEvent</code> Events</h4>
- <dl title="[Constructor(DOMString type, optional UISecurityPolicyViolationEventInit eventInitDict)] partial interface SecurityPolicyViolationEvent : Event" class="idl">
+ <dl title="[Constructor(DOMString type, optional SecurityPolicyViolationEventInit eventInitDict)] partial interface SecurityPolicyViolationEvent : Event" class="idl">
<dt>readonly attribute DOMString blockedEventType</dt>
<dd>Refer to the <a href="#report-uri"><code>blocked-event-type</code></a> property of violation reports for a description of this property.</dd>
@@ -641,10 +640,10 @@
<dl title="partial interface Security Policy" class="idl">
<dt>readonly attribute bool inputProtection</dt>
- <dd>A boolean representing <code>or</code> of whether
+ <dd>A boolean representing the logical <code>or</code> of whether
the <code>input-protection</code> directive is present or implied in
- each of the <a href="#dfn-active-csp-policies">active CSP
- policies</a>.</dd>
+ each of the <a href="https://dvcs.w3.org/hg/content-security-policy/raw-file/45f6ccaba0ef/csp-specification.dev.html#dfn-active-csp-policies">active CSP
+ policies</a>. [[CSP11]]</dd>
</dl>
</section>