Add "json" destination for "connect-src"

[nicolo-ribaudo]

whatwg/fetch#1691 adds "json" destinatino to the fetch spec (see whatwg/html#9486 and whatwg/html#7233 for motivation). Given that JSON modules are powerless and they they are so far usually loaded using fetch(), the intention is for them to re-use the connect-src CSP policy.

fyi @annevk @domenic

Closes #573.

[nicolo-ribaudo]

The linking errors seem to be unrelated to this change 🤔

➜ make           
bikeshed -f spec ./index.bs
LINE ~1628: Multiple possible 'url' dfn refs for '['/']'.
Arbitrarily chose https://url.spec.whatwg.org/#concept-url
To auto-select one of the following refs, insert one of these lines into a <pre class=link-defaults> block:
spec:url; type:dfn; text:url
spec:pub-manifest; type:dfn; text:url
[=/URL=]
LINE ~1630: Multiple possible 'url' dfn refs for '['/']'.
Arbitrarily chose https://url.spec.whatwg.org/#concept-url
To auto-select one of the following refs, insert one of these lines into a <pre class=link-defaults> block:
spec:url; type:dfn; text:url
spec:pub-manifest; type:dfn; text:url
[=/URL=]
LINK ERROR: Multiple possible 'url' dfn refs for '['/']'.
Arbitrarily chose https://url.spec.whatwg.org/#concept-url
To auto-select one of the following refs, insert one of these lines into a <pre class=link-defaults> block:
spec:url; type:dfn; text:url
spec:pub-manifest; type:dfn; text:url
[=/URL=]
LINE ~4023: Multiple possible 'url' dfn refs for '['/']'.
Arbitrarily chose https://url.spec.whatwg.org/#concept-url
To auto-select one of the following refs, insert one of these lines into a <pre class=link-defaults> block:
spec:url; type:dfn; text:url
spec:pub-manifest; type:dfn; text:url
[=/URL=]
WARNING: W3C policy requires Privacy Considerations and Security Considerations to be separate sections, but you appear to have them combined into one.
 ✔  Successfully generated, with 4 linking errors

[annevk]

I wonder why this setup doesn't automatically return that as an otherwise clause. Why would we want to fallback to no CSP enforcement? That seems wrong. (To be clear, not a question for OP, but rather for @antosart.)

[antosart]

The compilation issue should be fixed by #613.

[antosart]

It would make sense to me that we always fall back to connect-src. Comparing https://fetch.spec.whatwg.org/#concept-request-destination with https://w3c.github.io/webappsec-csp/#effective-directive-for-a-request, all destinations are currently handled apart from "report". (Should CSP apply to CSP reports? I guess so, so that should also be fixed. EDIT: Vendors don't apply CSP to reports, and in fact that sounds totally fine sine report endpoints need to be specified in headers.)

[nicolo-ribaudo]

Thanks @antosart! Do you think this PR should still be (rebased and) merged to have the explicit case, or should I close it given that now we have the default fallback in place?

[antosart]

@nicolo-ribaudo I think explicitly enumerating is better than relying on the fallback, so yes, let's keep this PR, thanks!

I'm not sure about the state of whatwg/fetch#1691, we should probably wait for that PR to be merged or ready to be merged.

[annevk]

The Fetch PR has been merged now @antosart.

[antosart]

Thanks. Merging this now then!