CSP 1.1: Remove the script interface to the set of enforced policies.

The current API is poor, and not what we'd like to run with going
forward. Alex Russell and Yehuda Katz have strongly argued for and
outlined a better take on an API ([1], [2]). Removing the current
definition to make room for a future definition along the lines of
their proposals.

This patch does not, however, remove the event fired upon violation
of the set of currently active policies. That seems to stand alone
quite cleanly.

[1]: http://infrequently.org/2013/05/use-case-zero/
[2]: http://yehudakatz.com/2013/05/24/an-extensible-approach-to-browser-security-policy/

Author: mikewest

csp-specification.dev.html

@@ -1056,87 +1056,7 @@ <h5>Firing events using the <code>SecurityPolicyViolationEvent</code> interface<
           </section>
 
         </section>
-
-        <section>
-          <h4>Document</h4>
-
-          <dl title="partial interface Document" class="idl">
-            <dt>readonly attribute SecurityPolicy securityPolicy</dt>
-            <dd>The security policy for this document.</dd>
-            <dt>attribute EventHandler onsecuritypolicyviolation</dt>
-            <dd>Event handler for <code>securitypolicyviolation</code> events.</dd>
-          </dl>
-        </section>
-
-        <section>
-          <h4>SecurityPolicy</h4>
-
-          <p>Let the <dfn>active CSP policies</dfn> be the set of CSP policies
-          the user agent is currently enforcing for the associated
-          document.</p>
-
-          <dl title="interface SecurityPolicy" class="idl">
-            <dt>readonly attribute bool allowsEval</dt>
-            <dd>A boolean representing the logical <code>and</code> of whether
-            the source expression <code>'unsafe-eval'</code> is present in the
-            <a href="#dfn-allowed-script-sources">allowed script sources</a>
-            of each of the <a href="#dfn-active-csp-policies">active CSP
-            policies</a>.</dd>
-
-            <dt>readonly attribute bool allowsInlineScript</dt>
-            <dd>A boolean representing the logical <code>and</code> of whether
-            the source expression <code>'unsafe-inline'</code> is present in the
-            <a href="#dfn-allowed-script-sources">allowed script sources</a>
-            of each of the <a href="#dfn-active-csp-policies">active CSP
-            policies</a>.</dd>
-
-            <dt>readonly attribute bool allowsInlineStyle</dt>
-            <dd>A boolean representing the logical <code>and</code> of whether
-            the source expression <code>'unsafe-inline'</code> is present in the
-            <a href="#dfn-allowed-style-sources">allowed style sources</a>
-            of each of the <a href="#dfn-active-csp-policies">active CSP
-            policies</a>.</dd>
-
-            <dt>readonly attribute bool isActive</dt>
-            <dd>A boolean which is <code>true</code> if the set of
-            <a href="#dfn-active-csp-policies">active CSP policies</a> is
-            non-empty, and <code>false</code> otherwise.</dd>
-          </dl>
-        </section>
-        <section class="informative">
-          <h4>Usage</h4>
-          <p>The script interface described here serves as a feature detection
-          API that developers can use in order to make intelligent decisions
-          about code that executes on a page based on the page's active
-          policy. This is especially important for developers of libraries or
-          frameworks which are meant to be used on a variety of sites in
-          unknown contexts.</p>
-          <p>A few use-cases follow for illustration:</p>
-          <ul>
-            <li>
-              <p><strong>Does the user agent support CSP?</strong></p>
-              <pre>var isCSPSupported = "securityPolicy" in document;</pre>
-            </li>
-            <li>
-              <p><strong>Is a policy active on the current page?</strong> If
-              not, perhaps one should be injected via the
-              <a href="#html-meta-element--experimental">(experimental)
-              <code>meta</code> element</a>.</p>
-              <pre>var isCSPActive = document.securityPolicy.isActive;</pre>
-            </li>
-            <li>
-              <p><strong>Can I use <code>new Function();</code> or
-              <code>eval()</code>?</strong> Some libraries use these dangerous
-              methods for performance optimizations. If they are unavailable,
-              the library could gracefully fall back to a less performant (but
-              safer) mechanism.</p>
-              <pre>var isEvalAvailable = document.securityPolicy.allowsEval;</pre>
-            </li>
-          </ul>
-        </section>
-      </section>
     </section>
-
     <section>
       <h2 id="sec-directives">Directives</h2>