@nimbus21.ai/chrome-devtools-mcp 0.6.3 → 0.12.2

package/build/src/third_party/issue-descriptions/corsInvalidHeaderValues.md

@@ -0,0 +1,7 @@
+# Ensure CORS response header values are valid
+
+A cross-origin resource sharing (CORS) request was blocked because of invalid or missing response headers of the request or the associated [preflight request](issueCorsPreflightRequest).
+
+To fix this issue, ensure the response to the CORS request and/or the associated [preflight request](issueCorsPreflightRequest) are not missing headers and use valid header values.
+
+Note that if an opaque response is sufficient, the request's mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers are not required but the response content is inaccessible (opaque).

package/build/src/third_party/issue-descriptions/corsLocalNetworkAccessPermissionDenied.md

@@ -0,0 +1,19 @@
+# Ensure that local network requests are compatible with upcoming restrictions
+
+A site requested a resource from a network that it could only access because of
+its users' privileged network position.
+
+These requests expose devices and servers to the internet, increasing the risk
+of a cross-site request forgery (CSRF) attack and/or information leakage.
+
+To mitigate these risks, Chrome will begin requiring the user grant explicit
+permission before a site can make local network requests. Local network requests
+are those that go to either private IP addresses, .local domains, or loopback
+addresses. Additionally, Chrome will block local network requests (both
+subframes and subresources) when initiated from non-secure contexts.
+
+If the user explicitly grants the permission, the site can make local network
+requests over HTTP for hostnames that are private IP addresses, .local
+hostnames, or to localhost. Sites can also set the `targetAddressSpace` fetch
+option to `private` or `local` to mark requests as being local network requests,
+which will allow them to be made over HTTP.

package/build/src/third_party/issue-descriptions/corsMethodDisallowedByPreflightResponse.md

@@ -0,0 +1,5 @@
+# Ensure CORS request uses allowed method
+
+A cross-origin resource sharing (CORS) request was blocked because it neither uses one of the CORS-safelisted methods (`GET`, `HEAD`, `POST`) nor was the request method explicitly allowed by the `Access-Control-Allow-Methods` response header of the associated [preflight request](issueCorsPreflightRequest).
+
+To fix this issue, include the request method in the `Access-Control-Allow-Methods` header of the associated preflight request.

package/build/src/third_party/issue-descriptions/corsNoCorsRedirectModeNotFollow.md

@@ -0,0 +1,5 @@
+# Ensure no-cors requests configure redirect mode follow
+
+A cross-origin resource sharing (CORS) request was blocked because it was configured to use request mode `no-cors` but did not use the redirect mode `follow`.
+
+To fix this issue, ensure that whenever the request mode `no-cors` is set then the redirect mode is set to `follow`.

package/build/src/third_party/issue-descriptions/corsOriginMismatch.md

@@ -0,0 +1,6 @@
+# Ensure CORS requesting origin matches resource's allowed origin
+
+A cross-origin resource sharing (CORS) request was blocked because the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) specified an origin different from the origin of the context that initiated the request.
+
+To fix this issue, ensure that the `Access-Control-Allow-Origin` header for the resource matches the request context's origin.
+If the resource never needs to be accessed with credentials, the `Access-Control-Allow-Origin` header may be set to a wildcard `*` to allow access from everywhere.

package/build/src/third_party/issue-descriptions/corsPreflightAllowPrivateNetworkError.md

@@ -0,0 +1,10 @@
+# Ensure private network requests are only made to resources that allow them
+
+A site requested a resource from a network that it could only access because of its users' privileged network position.
+These requests expose devices and servers to the internet, increasing the risk of a cross-site request forgery (CSRF) attack, and/or information leakage.
+
+To mitigate these risks, Chrome will require non-public subresources to opt-into being accessed with a preflight request and will start blocking them in Chrome 130 (October 2024).
+
+To fix this issue, ensure that response to the [preflight request](issueCorsPreflightRequest) for the private network resource has the `Access-Control-Allow-Private-Network` header set to `true`.
+
+Administrators can make use of the `InsecurePrivateNetworkRequestsAllowed` and `InsecurePrivateNetworkRequestsAllowedForUrls` enterprise policies to temporarily disable this restriction on all or certain websites.

package/build/src/third_party/issue-descriptions/corsPreflightResponseInvalid.md

@@ -0,0 +1,5 @@
+# Ensure preflight responses are valid
+
+A cross-origin resource sharing (CORS) request was blocked because the response to the associated [preflight request](issueCorsPreflightRequest) failed, had an unsuccessful HTTP status code, and/or was a redirect.
+
+To fix this issue, ensure all CORS preflight `OPTIONS` requests are answered with a successful HTTP status code (2xx) and do not redirect.

package/build/src/third_party/issue-descriptions/corsPrivateNetworkPermissionDenied.md

@@ -0,0 +1,10 @@
+# Ensure that private network requests made from secure context to plaintext resources can gain access based on user permission
+
+A site requested a resource from a network that it could only access because of its users' privileged network position.
+These requests expose devices and servers to the internet, increasing the risk of a cross-site request forgery (CSRF) attack and/or information leakage.
+
+To mitigate these risks, Chrome deprecates requests to non-public subresources when initiated from non-secure contexts. See the [feature status](PNASecureContextRestrictionFeatureStatus).
+
+Setting a `targetAddressSpace` fetch option to `private` or `local` allows secure contexts to fetch private network resources over HTTP, which is normally forbidden by mixed-content checks. The target server must respond affirmatively to a preflight request, and the user must grant explicit permission.
+
+Make sure that the response to the [preflight request](issueCorsPreflightRequest) for the private network resource has the `Private-Network-Access-Id` and `Private-Network-Access-Name` header properly set. `Private-Network-Access-Id` should be the device's MAC address and `Private-Network-Access-Name` should be a human-friendly device name.

package/build/src/third_party/issue-descriptions/corsRedirectContainsCredentials.md

@@ -0,0 +1,5 @@
+# Ensure CORS requests are not redirected to URLs containing credentials
+
+A cross-origin resource sharing (CORS) request was blocked because the response was a redirect to a URL that includes credentials, i.e. redirected to a URL of the form `https://username:password@example.com`.
+
+To fix this issue, ensure CORS requests are not redirected to URLs that include credentials.

package/build/src/third_party/issue-descriptions/corsWildcardOriginNotAllowed.md

@@ -0,0 +1,8 @@
+# Ensure credentialed requests are not sent to CORS resources with origin wildcards
+
+A cross-origin resource sharing (CORS) request was blocked because it was configured to `include` credentials and the `Access-Control-Allow-Origin` response header of the request or the associated [preflight request](issueCorsPreflightRequest) was set to a wildcard `*`. CORS requests may only include credentials for resources where the `Access-Control-Allow-Origin` header is not a wildcard.
+
+To fix this issue, ensure that either the request is configured to not include credentials, or change the `Access-Control-Allow-Origin` header of the resource to not be a wildcard.
+
+Note that if an opaque response is sufficient, the request's mode can be set to `no-cors` to fetch the resource with CORS disabled; that way CORS headers are not required but credentials are not sent and the response content is inaccessible (opaque).
+

package/build/src/third_party/issue-descriptions/cspEvalViolation.md

@@ -0,0 +1,9 @@
+# Content Security Policy of your site blocks the use of 'eval' in JavaScript`
+
+The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
+
+To solve this issue, avoid using `eval()`, `new Function()`, `setTimeout([string], ...)` and `setInterval([string], ...)` for evaluating strings.
+
+If you absolutely must: you can enable string evaluation by adding `unsafe-eval` as an allowed source in a `script-src` directive.
+
+⚠️ Allowing string evaluation comes at the risk of inline script injection.

package/build/src/third_party/issue-descriptions/cspInlineViolation.md

@@ -0,0 +1,10 @@
+# Content Security Policy blocks inline execution of scripts and stylesheets
+
+The Content Security Policy (CSP) prevents cross-site scripting attacks by blocking inline execution of scripts and style sheets.
+
+To solve this, move all inline scripts (e.g. `onclick=[JS code]`) and styles into external files.
+
+⚠️ Allowing inline execution comes at the risk of script injection via injection of HTML script elements. If you absolutely must, you can allow inline script and styles by:
+
+* adding `unsafe-inline` as a source to the CSP header
+* adding the hash or nonce of the inline script to your CSP header.

package/build/src/third_party/issue-descriptions/cspTrustedTypesPolicyViolation.md

@@ -0,0 +1,5 @@
+# Trusted Type policy creation blocked by Content Security Policy
+
+Your site tries to create a Trusted Type policy that has not been allowed by the Content Security Policy. The Content Security Policy may restrict the set of valid names for Trusted Type policies, and forbid more than one policy of each name.
+
+To solve this, make sure that the names of the policies listed below are declared in the `trusted-types` CSP directive. To allow redefining policies add the `allow-duplicates` keyword. If you want to remove all restrictions on policy names, remove the `trusted-types` directive entirely (not recommended).

package/build/src/third_party/issue-descriptions/cspTrustedTypesSinkViolation.md

@@ -0,0 +1,8 @@
+# Trusted Type expected, but String received
+
+Your site tries to use a plain string in a DOM modification where a Trusted Type is expected. Requiring Trusted Types for DOM modifications helps to prevent cross-site scripting attacks.
+
+To solve this, provide a Trusted Type to all the DOM modifications listed below. You can convert a string into a Trusted Type by:
+
+* defining a policy and using its corresponding `createHTML`, `createScript` or `createScriptURL` function.
+* defining a policy named `default` which will be automatically called.

package/build/src/third_party/issue-descriptions/cspURLViolation.md

@@ -0,0 +1,10 @@
+# Content Security Policy of your site blocks some resources
+
+Some resources are blocked because their origin is not listed in your site's Content Security Policy (CSP). Your site's CSP is allowlist-based, so resources must be listed in the allowlist in order to be accessed.
+
+A site's Content Security Policy is set either via an HTTP header (recommended), or via a meta HTML tag.
+
+To fix this issue do one of the following:
+
+* (Recommended) If you're using an allowlist for `'script-src'`, consider switching from an allowlist CSP to a strict CSP, because strict CSPs are [more robust against XSS](issuesCSPWhyStrictOverAllowlist). [See how to set a strict CSP](issuesCSPSetStrict).
+* Or carefully check that all of the blocked resources are trustworthy; if they are, include their sources in the CSP of your site. ⚠️Never add a source you don't trust to your site's CSP. If you don't trust the source, consider hosting resources on your own site instead.

package/build/src/third_party/issue-descriptions/deprecation.md

@@ -0,0 +1,3 @@
+# {PLACEHOLDER_title}
+
+{PLACEHOLDER_message}

package/build/src/third_party/issue-descriptions/federatedAuthRequestAccountsHttpNotFound.md

@@ -0,0 +1 @@
+# The provider's accounts list endpoint cannot be found.

package/build/src/third_party/issue-descriptions/federatedAuthRequestAccountsInvalidResponse.md

@@ -0,0 +1 @@
+# Provider's accounts list is invalid.

package/build/src/third_party/issue-descriptions/federatedAuthRequestAccountsNoResponse.md

@@ -0,0 +1 @@
+# The response body is empty when fetching the provider's accounts list.

package/build/src/third_party/issue-descriptions/federatedAuthRequestApprovalDeclined.md

@@ -0,0 +1 @@
+# User declined the sign-in attempt.

package/build/src/third_party/issue-descriptions/federatedAuthRequestCanceled.md

@@ -0,0 +1 @@
+# The request has been aborted.

package/build/src/third_party/issue-descriptions/federatedAuthRequestClientMetadataHttpNotFound.md

@@ -0,0 +1 @@
+# The provider's client metadata endpoint cannot be found.

package/build/src/third_party/issue-descriptions/federatedAuthRequestClientMetadataInvalidResponse.md

@@ -0,0 +1 @@
+# Provider's client metadata is invalid.

package/build/src/third_party/issue-descriptions/federatedAuthRequestClientMetadataNoResponse.md

@@ -0,0 +1 @@
+# The response body is empty when fetching the provider's client metadata.

package/build/src/third_party/issue-descriptions/federatedAuthRequestErrorFetchingSignin.md

@@ -0,0 +1 @@
+# Error attempting to reach the provider's sign-in endpoint.

package/build/src/third_party/issue-descriptions/federatedAuthRequestErrorIdToken.md

@@ -0,0 +1 @@
+# Error retrieving a token.

package/build/src/third_party/issue-descriptions/federatedAuthRequestIdTokenHttpNotFound.md

@@ -0,0 +1 @@
+# The provider's id token endpoint cannot be found.

package/build/src/third_party/issue-descriptions/federatedAuthRequestIdTokenInvalidRequest.md

@@ -0,0 +1 @@
+# The token fetching request is invalid.

package/build/src/third_party/issue-descriptions/federatedAuthRequestIdTokenInvalidResponse.md

@@ -0,0 +1 @@
+# Provider's token is invalid.

package/build/src/third_party/issue-descriptions/federatedAuthRequestIdTokenNoResponse.md

@@ -0,0 +1 @@
+# The response body is empty when fetching the provider's token.

package/build/src/third_party/issue-descriptions/federatedAuthRequestInvalidSigninResponse.md

@@ -0,0 +1 @@
+# Provider's sign-in response is invalid.

package/build/src/third_party/issue-descriptions/federatedAuthRequestManifestHttpNotFound.md

@@ -0,0 +1 @@
+# The provider's FedCM manifest configuration cannot be found.

package/build/src/third_party/issue-descriptions/federatedAuthRequestManifestInvalidResponse.md

@@ -0,0 +1 @@
+# Provider's FedCM manifest configuration is invalid.

package/build/src/third_party/issue-descriptions/federatedAuthRequestManifestNoResponse.md

@@ -0,0 +1 @@
+# The response body is empty when fetching the provider's FedCM manifest configuration.

package/build/src/third_party/issue-descriptions/federatedAuthRequestTooManyRequests.md

@@ -0,0 +1 @@
+# Only one navigator.credentials.get request may be outstanding at one time.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestInvalidAccountsResponse.md

@@ -0,0 +1 @@
+# getUserInfo() failed because of an invalid accounts response.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestInvalidConfigOrWellKnown.md

@@ -0,0 +1 @@
+# getUserInfo() failed because the config and well-known files were invalid.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNoAccountSharingPermission.md

@@ -0,0 +1 @@
+# getUserInfo() failed because the user has not yet used FedCM on this site with the provided IDP.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNoApiPermission.md

@@ -0,0 +1 @@
+# getUserInfo() is disabled because FedCM is disabled.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNoReturningUserFromFetchedAccounts.md

@@ -0,0 +1 @@
+# getUserInfo() failed because no account received was a returning account.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNotIframe.md

@@ -0,0 +1 @@
+# getUserInfo() caller is not an iframe.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNotPotentiallyTrustworthy.md

@@ -0,0 +1 @@
+# getUserInfo() failed because the config URL is not potentially trustworthy.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNotSameOrigin.md

@@ -0,0 +1 @@
+# getUserInfo() caller is not same origin as the config URL.

package/build/src/third_party/issue-descriptions/federatedAuthUserInfoRequestNotSignedInWithIdp.md

@@ -0,0 +1 @@
+# getUserInfo() is disabled because the IDP Sign-In Status is signed-out.

package/build/src/third_party/issue-descriptions/fetchingPartitionedBlobURL.md

@@ -0,0 +1,7 @@
+# Fetching Partitioned Blob URL Issue
+
+This issue occurs when a Blob URL access attempt was blocked because it was made from a cross-partition, same-origin context.
+
+Make sure the Blob URL was created in the same [storage partition](storagePartitioningExplainer) as the context it is being fetched from.
+
+If access to unpartitioned Blob URLs is needed, the Storage Access API [can be used](storageAccessAPI).

package/build/src/third_party/issue-descriptions/genericFormAriaLabelledByToNonExistingIdError.md

@@ -0,0 +1,8 @@
+# An aria-labelledby attribute doesn't match any element id
+
+An `aria-labelledby` attribute doesn't match any element `id`. This might prevent
+the browser from correctly autofilling the form and accessibility tools from
+working correctly.
+
+To fix this issue, make sure that `aria-labelledby` is a space-separated list of
+element `id`s.

package/build/src/third_party/issue-descriptions/genericFormAutocompleteAttributeEmptyError.md

@@ -0,0 +1,5 @@
+# Incorrect use of autocomplete attribute
+
+A form field's `autocomplete` attribute is empty. This might prevent the browser from correctly autofilling the form.
+
+To fix this issue, provide a valid `autocomplete` value.

package/build/src/third_party/issue-descriptions/genericFormDuplicateIdForInputError.md

@@ -0,0 +1,5 @@
+# Duplicate form field id in the same form
+
+Multiple form field elements in the same form have the same `id` attribute value. This might prevent the browser from correctly autofilling the form.
+
+To fix this issue, use unique `id` attribute values for each form field.

package/build/src/third_party/issue-descriptions/genericFormEmptyIdAndNameAttributesForInputError.md

@@ -0,0 +1,5 @@
+# A form field element should have an id or name attribute
+
+A form field element has neither an `id` nor a `name` attribute. This might prevent the browser from correctly autofilling the form.
+
+To fix this issue, add a unique `id` or `name` attribute to a form field. This is not strictly needed, but still recommended even if you have an autocomplete attribute on the same element.

package/build/src/third_party/issue-descriptions/genericFormInputAssignedAutocompleteValueToIdOrNameAttributeError.md

@@ -0,0 +1,5 @@
+# An element doesn't have an autocomplete attribute
+
+A form field has an `id` or `name` attribute that the browser's autofill recognizes. However, it doesn't have an `autocomplete` attribute assigned. This might prevent the browser from correctly autofilling the form.
+
+To fix this issue, provide an `autocomplete` attribute.

package/build/src/third_party/issue-descriptions/genericFormInputHasWrongButWellIntendedAutocompleteValueError.md

@@ -0,0 +1,5 @@
+# Non-standard `autocomplete` attribute value
+
+An `autocomplete` attribute of a form field uses a non-standard HTML value. This might prevent the browser from correctly autofilling the form.
+
+To fix this issue, use a valid `autocomplete` value.

package/build/src/third_party/issue-descriptions/genericFormInputWithNoLabelError.md

@@ -0,0 +1,5 @@
+# Form field without valid aria-labelledby attribute or associated label
+
+A form field has neither a valid `aria-labelledby` attribute nor an associated `<label>`. This might prevent the browser from correctly autofilling the form and accessibility tools from working correctly.
+
+To fix this issue, provide a `<label>` describing the purpose of the form field.

package/build/src/third_party/issue-descriptions/genericFormLabelForMatchesNonExistingIdError.md

@@ -0,0 +1,5 @@
+# Incorrect use of <label for=FORM_ELEMENT>
+
+The label's `for` attribute doesn't match any element `id`. This might prevent the browser from correctly autofilling the form and accessibility tools from working correctly.
+
+To fix this issue, make sure the label's `for` attribute references the correct `id` of a form field.

package/build/src/third_party/issue-descriptions/genericFormLabelForNameError.md

@@ -0,0 +1,5 @@
+# Incorrect use of <label for=FORM_ELEMENT>
+
+The label's `for` attribute refers to a form field by its `name`, not its `id`. This might prevent the browser from correctly autofilling the form and accessibility tools from working correctly.
+
+To fix this issue, refer to form fields by their `id` attribute.

package/build/src/third_party/issue-descriptions/genericFormLabelHasNeitherForNorNestedInputError.md

@@ -0,0 +1,5 @@
+# No label associated with a form field
+
+A `<label>` isn't associated with a form field.
+
+To fix this issue, nest the `<input>` in the `<label>` or provide a `for` attribute on the `<label>` that matches a form field `id`.

package/build/src/third_party/issue-descriptions/genericNavigationEntryMarkedSkippable.md

@@ -0,0 +1,7 @@
+# Session History Item Has Been Marked Skippable
+
+A session history item was added by this document without any interaction from the
+user. As a result, this document's history items will be skipped if the user goes
+back or forward via the browser's UI (e.g., back/forward buttons), to prevent pages
+from trapping a user. If the user interacts with the page, the history items
+will no longer be skipped.

package/build/src/third_party/issue-descriptions/genericResponseWasBlockedByORB.md

@@ -0,0 +1,4 @@
+# Response was blocked by CORB (Cross-Origin Read Blocking)
+
+Cross-Origin Read Blocking (CORB) blocked a cross-origin response.
+

package/build/src/third_party/issue-descriptions/heavyAd.md

@@ -0,0 +1,10 @@
+# An ad on your site has exceeded resource limits
+
+Chrome identifies heavy ads on your site that use too many resources without a user gesture. Heavy ads have an impact on performance and harm the user’s browsing experience. They increase battery drain, consume mobile data, and make your site slow. To improve the user experience, Chrome warns about or removes heavy ads.
+
+An ad is considered heavy if the user has not interacted with it (for example, has not tapped or clicked it) and it meets any of the following criteria:
+* Uses the main thread for more than 60 seconds in total (CPU total limit)
+* Uses the main thread for more than 15 seconds in any 30 second window (CPU peak limit)
+* Uses more than 4 megabytes of network bandwidth (Network limit)
+
+Stop this from happening by only showing ads that stay within resource limits.

package/build/src/third_party/issue-descriptions/mixedContent.md

@@ -0,0 +1,5 @@
+# Mixed content: load all resources via HTTPS to improve the security of your site
+
+Even though the initial HTML page is loaded over a secure HTTPS connection, some resources like images, stylesheets or scripts are being accessed over an insecure HTTP connection. Usage of insecure resources is restricted to strengthen the security of your entire site.
+
+To resolve this issue, load all resources over a secure HTTPS connection.

package/build/src/third_party/issue-descriptions/navigatingPartitionedBlobURL.md

@@ -0,0 +1,5 @@
+# Navigating Partitioned Blob URL Issue
+
+This issue occurs when 'noopener' was enforced during navigation to a cross-partition, same-origin Blob URL. The navigation won't be blocked due to it being cross-partition, but APIs like window.open won't return a WindowProxy for the new window in this case.
+
+If your application requires a WindowProxy object to be returned by navigating to the Blob URL, make sure the Blob URL has the same top-level site as the context it is navigated fetched from.

package/build/src/third_party/issue-descriptions/permissionElementActivationDisabled.md

@@ -0,0 +1,7 @@
+# Activation disabled
+
+The "{PLACEHOLDER_Type}" element could not be activated for the following reason: {PLACEHOLDER_DisableReason}.
+
+To resolve this issue, ensure that the element follows all styling restrictions and is fully visible to the user.
+
+You can use the command line flag `--runtime-enabled-features=BypassPepcSecurityForTesting` to bypass this behavior for testing purposes.

package/build/src/third_party/issue-descriptions/permissionElementActivationDisabledWithOccluder.md

@@ -0,0 +1,9 @@
+# Activation disabled
+
+The "{PLACEHOLDER_Type}" element could not be activated for the following reason: {PLACEHOLDER_DisableReason}.
+
+The element is occluded by: "{PLACEHOLDER_OccluderInfo}"
+
+To resolve this issue, ensure that the element follows all styling restrictions and is fully visible to the user.
+
+You can use the command line flag `--runtime-enabled-features=BypassPepcSecurityForTesting` to bypass this behavior for testing purposes.

package/build/src/third_party/issue-descriptions/permissionElementActivationDisabledWithOccluderParent.md

@@ -0,0 +1,9 @@
+# Activation disabled
+
+The "{PLACEHOLDER_Type}" element could not be activated for the following reason: {PLACEHOLDER_DisableReason}.
+
+The element is occluded by: "{PLACEHOLDER_OccluderInfo}" (parent element: "{PLACEHOLDER_OccluderParentInfo}")
+
+To resolve this issue, ensure that the element follows all styling restrictions and is fully visible to the user.
+
+You can use the command line flag `--runtime-enabled-features=BypassPepcSecurityForTesting` to bypass this behavior for testing purposes.

package/build/src/third_party/issue-descriptions/permissionElementCspFrameAncestorsMissing.md

@@ -0,0 +1,5 @@
+# CSP `frame-ancestors` missing
+
+The "{PLACEHOLDER_Type}" element is used in a cross-origin iframe, but the required `frame-ancestors` Content Security Policy directive is missing.
+
+To resolve this issue, add a `frame-ancestors` Content Security Policy directive to the iframe.

package/build/src/third_party/issue-descriptions/permissionElementFencedFrameDisallowed.md

@@ -0,0 +1,5 @@
+# Fenced frame disallowed
+
+The "{PLACEHOLDER_Type}" element is not allowed in a fenced frame.
+
+To resolve this issue, ensure the element is not used in a fenced frame.

package/build/src/third_party/issue-descriptions/permissionElementFontSizeTooLarge.md

@@ -0,0 +1,5 @@
+# Font size too large
+
+The "{PLACEHOLDER_Type}" element's font size is too large.
+
+To resolve this issue, ensure that the element's font is at most 'xx-large'.

package/build/src/third_party/issue-descriptions/permissionElementFontSizeTooSmall.md

@@ -0,0 +1,5 @@
+# Font size too small
+
+The "{PLACEHOLDER_Type}" element's font size is too small.
+
+To resolve this issue, ensure that the element's font is at least 'small'.

package/build/src/third_party/issue-descriptions/permissionElementGeolocationDeprecated.md

@@ -0,0 +1,5 @@
+# Geolocation deprecated
+
+Using `<permission type="geolocation">` is deprecated.
+
+To resolve this issue, use the `<geolocation>` element instead.

package/build/src/third_party/issue-descriptions/permissionElementInsetBoxShadowUnsupported.md

@@ -0,0 +1,5 @@
+# Unsupported inset box shadow
+
+The "{PLACEHOLDER_Type}" element does not support `inset` box shadows.
+
+To resolve this issue, remove the `inset` keyword from the relevant stylesheet.

package/build/src/third_party/issue-descriptions/permissionElementInvalidDisplayStyle.md

@@ -0,0 +1,5 @@
+# Invalid display style
+
+The "{PLACEHOLDER_Type}" element has an invalid display style. Values that result in an unsupported layout are not allowed.
+
+To resolve this issue, consider using 'inline-block', 'block', or 'flex' instead.

package/build/src/third_party/issue-descriptions/permissionElementInvalidSizeValue.md

@@ -0,0 +1,5 @@
+# Invalid size value
+
+Content, intrinsic, or stretch sizes are not supported as values for the min/max width and height of the "{PLACEHOLDER_Type}" element.
+
+To resolve this issue, use absolute or relative lengths for the element's width and height.

package/build/src/third_party/issue-descriptions/permissionElementInvalidType.md

@@ -0,0 +1,5 @@
+# Invalid type attribute
+
+The "{PLACEHOLDER_Type}" type is not supported.
+
+To resolve this issue, ensure the element's type is one of the supported values: "camera", "microphone", "geolocation", "camera microphone".

package/build/src/third_party/issue-descriptions/permissionElementInvalidTypeActivation.md

@@ -0,0 +1,5 @@
+# Invalid type activation
+
+An element with the "{PLACEHOLDER_Type}" type was attempted to be activated. However this type is not supported.
+
+To resolve this issue, ensure the element's type is one of the supported values: "camera", "microphone", "geolocation", "camera microphone".

package/build/src/third_party/issue-descriptions/permissionElementLowContrast.md

@@ -0,0 +1,5 @@
+# Low contrast
+
+The contrast between the text color and background color of the "{PLACEHOLDER_Type}" element is too low.
+
+To resolve this issue, ensure that your text/background colors have more contrast between them.

package/build/src/third_party/issue-descriptions/permissionElementNonOpaqueColor.md

@@ -0,0 +1,5 @@
+# Non-opaque color
+
+The text color or background color of the "{PLACEHOLDER_Type}" element is non-opaque.
+
+To resolve this issue, ensure the element's text and background colors have their alpha channel value at 100%.

package/build/src/third_party/issue-descriptions/permissionElementPaddingBottomUnsupported.md

@@ -0,0 +1,6 @@
+# Unsupported bottom padding
+
+The "{PLACEHOLDER_Type}" element does not support `padding-bottom`.
+`padding-bottom` is always set to be identical to `padding-top`.
+
+To resolve this issue, ensure the element's `padding-bottom` is unset or identical to `padding-top`.

package/build/src/third_party/issue-descriptions/permissionElementPaddingRightUnsupported.md

@@ -0,0 +1,6 @@
+# Unsupported right padding
+
+The "{PLACEHOLDER_Type}" element does not support `padding-right`.
+`padding-right` is always set to be identical to `padding-left`.
+
+To resolve this issue, ensure the element's `padding-right` is unset or identical to `padding-left`.

package/build/src/third_party/issue-descriptions/permissionElementPermissionsPolicyBlocked.md

@@ -0,0 +1,5 @@
+# Permissions policy blocked
+
+The "{PLACEHOLDER_Type}" element is blocked by the "{PLACEHOLDER_PermissionName}" permission policy.
+
+To resolve this issue, ensure the frame which contains the element is loaded with the appropriate permission policy by its embedder.

package/build/src/third_party/issue-descriptions/permissionElementRegistrationFailed.md

@@ -0,0 +1,5 @@
+# Quota exceeded
+
+The "{PLACEHOLDER_Type}" element has surpassed the maximum instances quota per page.
+
+To resolve this issue, ensure that you have no more than 3 elements of the same type per page.

package/build/src/third_party/issue-descriptions/permissionElementRequestInProgress.md

@@ -0,0 +1,5 @@
+# Request in progress
+
+A permission request on the "{PLACEHOLDER_Type}" element was prevented because a previous request is still in progress.
+
+To resolve this issue, ensure that the site does not allow users to interact with the element behind the current content scrim (for example by moving the element to a document in a new window, which is not covered by the scrim).

package/build/src/third_party/issue-descriptions/permissionElementSecurityChecksFailed.md

@@ -0,0 +1,5 @@
+# Activation disabled (quota)
+
+The "{PLACEHOLDER_Type}" element could not be activated because the page's quota has been exceeded.
+
+To resolve this issue, ensure that you have no more than 3 elements of the same type per page.

package/build/src/third_party/issue-descriptions/permissionElementTypeNotSupported.md

@@ -0,0 +1,5 @@
+# Permission not supported
+
+The permission type "{PLACEHOLDER_Type}" is not supported by this browser and therefore the element will not be functional.
+
+To resolve this issue, ensure the element's type is one of the supported values: "camera", "microphone", "geolocation", "camera microphone".

package/build/src/third_party/issue-descriptions/permissionElementUntrustedEvent.md

@@ -0,0 +1,7 @@
+# Untrusted event
+
+The "{PLACEHOLDER_Type}" element can only be activated by actual user clicks, not simulated ones.
+
+To resolve this issue, do not use frameworks which simulate click events, (e.g. via `click()`) and do not prevent the `DOMActivate` event.
+
+You can use the command line flag `--runtime-enabled-features=BypassPepcSecurityForTesting` to bypass this behavior for testing purposes.

package/build/src/third_party/issue-descriptions/placeholderDescriptionForInvisibleIssues.md

@@ -0,0 +1,3 @@
+# This is a placeholder issue description
+
+This description is used for issues that are not intended to be shown to the user. This means there is no need for a useful description.

package/build/src/third_party/issue-descriptions/propertyRuleInvalidNameIssue.md

@@ -0,0 +1,3 @@
+# An @property rule was ignored
+
+An @property rule is ignored because the property name is invalid.

package/build/src/third_party/issue-descriptions/propertyRuleIssue.md

@@ -0,0 +1,7 @@
+# Ignored @property rule
+
+An @property rule is ignored because it contains an invalid property or is missing a required one:
+
+```
+{PLACEHOLDER_property}
+```

package/build/src/third_party/issue-descriptions/selectElementAccessibilityDisallowedOptGroupChild.md

@@ -0,0 +1,7 @@
+# Invalid element or text node within <optgroup>
+
+An element which is not allowed in the content model of the `<optgroup>` element was found within an `<optgroup>` element. These elements will not consistently be accessible to people navigating by keyboard or using assistive technology.
+
+If using disallowed elements for layout structure and styling, consider using the allowed `<div>` element instead.
+
+Any text existing within the `<optgroup>` element should either be removed or relocated to a valid element that allows text descendants, e.g., the `<legend>` or `<option>` elements.