<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [CSP] Violation report may be sent to wrong domain on frame-ancestors violation"
href="https://bugs.webkit.org/show_bug.cgi?id=162079#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [CSP] Violation report may be sent to wrong domain on frame-ancestors violation"
href="https://bugs.webkit.org/show_bug.cgi?id=162079">bug 162079</a>
from <span class="vcard"><a class="email" href="mailto:dbates@webkit.org" title="Daniel Bates <dbates@webkit.org>"> <span class="fn">Daniel Bates</span></a>
</span></b>
<pre>Note that reporting of a frame-ancestors violation for a document occurs before the URL of that document is known; => we do not have a script execution context. So we make use of the parent frame's document as part of the reporting machinery. Among other things we use the parent frame's document to compute the absolute URL for a CSP report URI that is a relative URL. But we should use the blocked URL as base of this computed absolute URL.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>