Skip to content

Instantly share code, notes, and snippets.

View zcorpan's full-sized avatar

Simon Pieters zcorpan

430 followers · 0 following
View GitHub Profile
@zcorpan
zcorpan / web-apis-csp.md
Created October 26, 2026 16:20
Web APIs that fetch and whether they are subject to a CSP directive

Which fetching web APIs are subject to a CSP directive?

Based on CSP3's Get the effective directive for request, which picks the directive from the request's destination. Fallbacks come from the fallback list. The list of APIs itself is based on this.

How this differs from Fetch's destination table

  • The table uses older, coarser directive names: child-src for <frame>/<iframe>, script-src for scripts, worklets and XSLT, style-src for styles. CSP3 picks frame-src, script-src-elem and style-src-elem first, and falls back to those names.
  • The table says downloads (initiator "download") and top-level navigations ("document") have no directive. CSP3's algorithm doesn't special-case
@zcorpan
zcorpan / meiert-normal.html
Created September 9, 2021 13:46
Compare gzip compression of omitting spaces between attributes (see https://twitter.com/j9t/status/1435910221550002179 )
<!DOCTYPE html><html lang=en><head><meta charset=utf-8><meta name=viewport content="initial-scale=1,minimum-scale=1,width=device-width"><meta name=description content="I’m Jens Oliver Meiert, and I’m an engineering manager and author. I’ve worked for a variety of companies, but one of my most important stations has been Google; I’ve written 16 books and booklets; and I’ve at some point traveled the world solo for one and a half years. Get to know me on meiert.com."><meta name=twitter:card content=summary><meta name=twitter:title content="Jens Oliver Meiert · Engineering Manager and Author · HTML and CSS Optimization"><meta name=twitter:description content="I’m Jens Oliver Meiert, and I’m an engineering manager and author. I’ve worked for a variety of companies, but one of my most important stations has been Google; I’ve written 16 books and booklets; and I’ve at some point traveled the world solo for one and a half years. Get to know me on meiert.com."><meta name=twitter:image content="https://d3rdtowr0c5lpf.
@zcorpan
zcorpan / NotRunFiles.csv
Created October 23, 2019 13:15
web-platform-tests tests that were disabled in Edge as of 8 May 2018 - https://github.com/web-platform-tests/wpt/issues/10655#issuecomment-387434035
Path Filename
audio-output setSinkId.https.html
content-security-policy/navigation to-javascript-url-script-src.html
content-security-policy/nonce-hiding script-nonces-hidden-meta.tentative.html
content-security-policy/nonce-hiding script-nonces-hidden.tentative.html
content-security-policy/nonce-hiding svgscript-nonces-hidden-meta.tentative.html
content-security-policy/nonce-hiding svgscript-nonces-hidden.tentative.html
content-security-policy/script-src javascript-window-open-blocked.html
content-security-policy/script-src script-src-multiple-policies-multiple-hashing-algorithms.html
content-security-policy/script-src script-src-multiple-policies-one-using-hashing-algorithms.html
@zcorpan
zcorpan / svg-resources-image-data-url-img-png.csv
Created April 12, 2019 22:43
httparchive analysis for crbug.com/952423 (looking for external SVG files)
page url match
https://pogonszczecin.pl/ https://pogonszczecin.pl/docs/partners/41392.svg <image id="Warstwa_1" data-name="Warstwa 1" x="12" y="7" width="121" height="43" xlink:href="data:img/png;
https://pogonszczecin.pl/ https://pogonszczecin.pl/docs/partners/72773.svg <image id="onet_logo_RGB" x="1" y="14" width="97" height="30" xlink:href="data:img/png;
https://www.meadens.co.uk/ https://www.meadens.co.uk/assets/images/meadens-group.svg <image width="208" height="43" xlink:href="data:img/png;
http://www.brookebond.ru/ http://www.brookebond.ru/images/svg-sprite/svg.svg <image xlink:href="data:img/png;
https://roofwindows.veluxshop.co.uk/ https://roofwindows.veluxshop.co.uk/-/media/roofwindowshop/master/creditcards/paypal.svg <image id="PayPal_2_" data-name="PayPal (2)" width="128" height="80" xlink:href="data:img/png;
https://roofwindows.veluxshop.co.uk/ https://roofwindows.veluxshop.co.uk/-/media/roofwindowshop/master/creditcards/visa.svg <image id="Visa
@zcorpan
zcorpan / svg-image-data-url-img-png.csv
Created April 12, 2019 21:57
httparchive analysis for crbug.com/952423
page match
https://wizoria.ua/ <image id="up-arrow.svg" width="16" height="10" xlink:href="data:img/png;
https://shop.us.deuscustoms.com/ <image id="Vector_Smart_Object" data-name="Vector Smart Object" width="130" height="130" xlink:href="data:img/png;
https://www.hotmat.se/ <image id="Vector_Smart_Object" data-name="Vector Smart Object" width="128" height="98" xlink:href="data:img/png;
https://nl.wix.com/ <image x="226" y="298.5" width="15" height="16" xlink:href="data:img/png;
https://www.lasikplus.com/ <image width="19" height="16" xlink:href="data:img/png;
https://www.lasikplus.com/ <image width="19" height="16" xlink:href="data:img/png;
http://www.astrosurf.com/ <image id="Icon-home-subnav" width="13" height="13" xlink:href="data:img/png;
https://industriyakrasoty.ru/ <image xlink:href="data:img/png;
https://www.indesit.co.uk/ <image width="23" height="29" xlink:href="data:img/png;
@zcorpan
zcorpan / custom-elements-with-attributes.csv
Last active October 6, 2025 03:43
Custom elements with attributes in httparchive
We can't make this file beautiful and searchable because it's too large.
num,match
1030,"<lb-component v-bind=""component_props"" v-on:hide_user=""hide_user"" v-on:show_user=""show_user"" v-on:load_profile_user=""load_profile_user"">"
1019,"<inventory-widget base-filter="""" rescan-on-event=""shown.bs.tab"" selector="" inventory-widget .active [{filterAttribute}]"">"
693,"<logo-svg height=""20"" width=""120"">"
369,"<tws-article-social class=\""tws-article-social\"" article-uid=\""articleUid\"">"
257,"<amp-analytics type=""googleanalytics"">"
244,"<custom-theme-component :shop=""shop"">"
217,"<tn-image-picker src=""selfService.siteLogo"">"
186,"<ts-icon class=""ts_icon ts_icon_times"">"
181,"<ns-header-category-menu ng-show=""HeaderCategoryMenuCtrl.IsOpendMenu===true""
@zcorpan
zcorpan / aria_label_grouped.csv
Created February 28, 2019 11:08
Usage of aria-label in httparchive
num element role aria_label title placeholder aria_placeholder aria_labelledby contents
20375 a learn more about cookies {{link}}
10771 div online ';return __p}.toString()).apply(void 0,_valu
8890 span Previous &#x2039;
6860 button '),l&&(l.isSingleImage?s.push('
6447 small {{::label.full}} {{::label.abbr}}
2918 small {{label.full}} {{label.abbr}}
1249 a View Feed View
1097 section
987 select
@zcorpan
zcorpan / appearance_none_display_inline.csv
Created October 30, 2018 09:34
CSS rules in httparchive with *-appearance: none and display: inline
We can't make this file beautiful and searchable because it's too large.
num,rule
785,"\n\n/* stylelint-disable selector-max-type */\n\n.gpz0by4,\ninput[type].gpz0by4 {\n animation: none 0s ease 0s 1 normal none running;\n backface-visibility: visible;\n background: transparent none repeat 0 0 / auto auto padding-box border-box scroll;\n border: medium none currentcolor;\n border-collapse: separate;\n border-image: none;\n border-radius: 0;\n border-spacing: 0;\n bottom: auto;\n box-shadow: none;\n box-sizing: content-box;\n caption-side: top;\n clear: none;\n clip: auto;\n color: #000;\n columns: auto;\n column-count: auto;\n column-fill: balance;\n column-gap: normal;\n column-rule: medium none currentcolor;\n column-span: 1;\n column-width: auto;\n content: normal;\n counter-increment: none;\n counter-reset: none;\n cursor: auto;\n direction: ltr;\n display: inline;\n empty-cells: show;\n float: none;\n font-family: serif;\n font-size: medium;\n font-style: normal;\n font-variant: normal;\n font-weight: normal;\n font-stretch: normal;\n line
@zcorpan
zcorpan / pages_webkit_appearance_menulist_textfield.csv
Created October 25, 2018 09:26
Pages in httparchive with -(webkit|moz)-appearance: menulist-textfield ordered by rank
rank page
6649 https://schedule.sxsw.com/
7938 https://www.bidorbuy.co.za/
18728 https://bluelink.hyundaiusa.com/
18728 https://bluelink.hyundaiusa.com/
21097 https://support.paloaltonetworks.com/
23725 http://biblioteca.unir.net/
26865 http://busqueda.gandhi.com.mx/
26865 https://www.gandhi.com.mx/
53653 https://www.benefitcosmetics.com/
@zcorpan
zcorpan / appearance_rules_by_num_not_none.csv
Created October 19, 2018 11:25
Style rules (including selector) containing -webkit-appearance or -moz-appearance (excluding 'none') in httparchive, grouped by rule and ordered by count
We can't make this file beautiful and searchable because it's too large.
num,rule
215016,"button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}"
98085,"button,html input[type=""button""],input[type=""reset""],input[type=""submit""]{-webkit-appearance:button;cursor:pointer}"
87311,".videoaduipopuptext input[type=""radio""]{-webkit-appearance:radio;border:1px solid;border-radius:50%;background-color:rgba(0,0,0,0.8)}"
31594,"button,
html input[type=""button""],
input[type=""reset""],
input[type=""submit""] {
-webkit-appearance: button;
cursor: pointer;