One thing that we have struggle with is the ability to control code executing arbitrary imports. In the realms-shim (polyfill for realms proposal) we rely on a regexp (yes, yes, we know, bugs keep coming). Additionally, when sandboxing via iframes we also struggle to prevent arbitrary import(). Since this feature is part of the grammar, there is no way to disable it, it becomes more challenging than eval. We have debated a couple of options:
CSP flag to signal to the host that import() should throw (this seems very bizarre and extreme)
One thing that we have struggle with is the ability to control code executing arbitrary imports. In the realms-shim (polyfill for realms proposal) we rely on a regexp (yes, yes, we know, bugs keep coming). Additionally, when sandboxing via iframes we also struggle to prevent arbitrary
import()
. Since this feature is part of the grammar, there is no way to disable it, it becomes more challenging thaneval
. We have debated a couple of options:CSP flag to signal to the host that
import()
should throw (this seems very bizarre and extreme)Use a generic import map to point to a module that throws for all import statements, or a subject of them. This is related to https://github.com/WICG/import-maps/issues/7
cc @jdalton