CSP

Go's concurrency model is based on CSP (Communicating Sequential Processes) theory, proposed by computer scientist Tony Hoare in 1978.

CSP最早由Mozilla在2004年前后提出概念，2012年作为W3C候选推荐标准（CSP Level 1）正式发布

GitHub和Twitter等大型网站利用CSP的report-uri/report-to机制收集CSP违规数据用于策略调优

Go's concurrency model is based on CSP theory, proposed by Tony Hoare in 1978, with the core idea of coordinating concurrent processes through message passing rather than shared memory.

Markdown lacks native security mechanisms like CSP, making isolation at the parsing layer more difficult.

Each POST request in the CSP replay probe carries a real application/csp-report payload containing fields such as blockedURL, disposition and effectiveDirective; result classifications include accepted, queued, auth_required, rejected_bad_request, endpoint_missing, rate_limited or fetch_error.

There are two CSP reporting mechanisms: the legacy method sends application/csp-report format JSON via the report-uri directive in the CSP header; the new standard declares endpoints via the Reporting-Endpoints header and uses the report-to directive, with reports in application/reports+json format.

The /api/csp-violation-replay endpoint fetches the target page, extracts the CSP header, meta CSP, Reporting-Endpoints header and report-uri/report-to configuration, and replays four violation scenarios—script_violation, style_violation, connect_violation and img_violation—against each declared endpoint.

PasteKit enforces local processing through a strict Content Security Policy (CSP) to prevent data leakage.

CSP itself is not an absolute guarantee against data leakage; it constrains the page's own resource-loading behavior, not browser extensions or OS-level monitoring.

The vulnerability is caused by incomplete coverage of the three-layer protection for HTML previews (CSP, data: URL isolation, and dev-server proxy filtering): files smaller than 256KB are loaded via data: URL and protected by CSP, while files larger than 256KB are written to a temporary file and loaded via the file:// protocol, a path that has neither CSP nor request filtering.

The Reado app defends against similar attacks in the following ways: HTML files open as source code by default, Markdown and notebook output is sanitized via rehype-sanitize, the app's own CSP allows only script-src 'self' and covers Workers, file size does not change the loading method, and local image access is restricted to the opened project.

In Chromium, a file:// page can use fetch() to read other local files and inherits no CSP.

CSP only takes effect on documents loaded via HTTP(S) or data: URLs, and local files loaded via the file:// protocol inherit no CSP by default.

Sanitizers are not a panacea and still need to be paired with the app's own strict CSP as defense in depth, because sanitizer rule libraries may have gaps while CSP is enforced by the browser, making the two complementary.

Inline scripts are subject to CSP restrictions and cannot execute on pages that disallow unsafe-inline.

The script-src directive of CSP controls script sources; if the policy does not include 'unsafe-inline', all inline <script> tags will be refused execution by the browser.

Under a strict CSP, this trick requires generating a nonce or hash for each inline script, which significantly increases server-side configuration complexity when there is a lot of dynamic content.

The standard solving method for CSP is backtracking search combined with constraint propagation (such as arc consistency), but combinatorial explosion occurs as the scale grows.

HTTP response headers are a batch of key-value pair metadata that the server sends before returning the body, covering content type, caching policy, security policy (such as CSP, HSTS), cross-origin control (CORS), and X-prefixed custom fields; the browser parses some fields but completely ignores unrecognized custom fields, and never displays them to the user.