← Back to release summary

CSP: `script-src-attr`, `script-src-elem`, `style-src-attr`, `style-src-elem` directives

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 75)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Incubation
Web Platform Tests: No

WPT details: https://wpt.fyi/results/content-security-policy/script-src-attr-elem?label=master&product=chrome%5Bexperimental%5D&product=edge&product=firefox%5Bexperimental%5D&product=safari%5Bexperimental%5D&aligned https://wpt.fyi/results/content-security-policy/script-src-attr-elem?label=master&product=chrome%5Bexperimental%5D&product=edge&product=firefox%5Bexperimental%5D&product=safari%5Bexperimental%5D&aligned

Summary

These 4 new directives provide the functionality of the script/style directive but with more granularity, applying to elements or attributes.

Standards & signals

Specification: https://w3c.github.io/webappsec-csp/
Firefox: No signal
Safari: No signal
Web developers: Positive — The SEAM Google team has plans for using this feature for a static page automatic CSP system. Also interest has been expressed for a method of only enabling "style" attributes to prevent CSS based attacks (as the one linked above).
Tracking bug: http://crbug.com/880816

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=content-security-policy%2Fscript-src-attr-elem
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+CSP%3A%20%60script-src-attr%60%2C%20%60script-src-elem%60%2C%20%60style-src-attr%60%2C%20%60style-src-elem%60%20directives
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=CSP%3A%20%60script-src-attr%60%2C%20%60script-src-elem%60%2C%20%60style-src-attr%60%2C%20%60style-src-elem%60%20directives
Baseline status: https://webstatus.dev/?q=CSP%3A%20%60script-src-attr%60%2C%20%60script-src-elem%60%2C%20%60style-src-attr%60%2C%20%60style-src-elem%60%20directives

Docs: https://w3c.github.io/webappsec-csp/#directive-script-src-attr https://w3c.github.io/webappsec-csp/#directive-script-src-elem https://w3c.github.io/webappsec-csp/#directive-style-src-attr https://w3c.github.io/webappsec-csp/#directive-style-src-elem

Explainers: https://docs.google.com/document/d/1_nYS4gWYO2Oh8rYDyPglXIKNsgCRVhmjHqWlTAHst7c/edit?usp=sharing%20(the%20%22Directives%20specific%20for%20script%20and%20style%20attributes%20and%20elements%20(option%202)%22%20section%20in%20particular)

View on chromestatus.com