search

whatwg / html

HTML Standard
https://html.spec.whatwg.org/multipage/
Other
8.1k stars 2.66k forks source link

Should strict MIME type for importScripts() also be enforced on local URLs? #8869

Open Kaiido opened 1 year ago

Kaiido commented 1 year ago

4001 set up a strict MIME type enforcement for importScripts(). However while all UAs seem to have agreed about external URLs, and tests are written for these, there is a compat issue regarding local URLs (data: and blob:).

Both Chrome and Firefox seem to not look at the MIME type of such URLs, while Safari and if I read correctly, the specs, do throw on these too. Quick test cases: data: URL, and blob: URL.

I'm not sure what would be the best here. These being local might warrant a special case (e.g I wouldn't be surprised to see a blob: URL pointing to a dynamically created script on which the type wasn't set).

Originally posted in https://github.com/whatwg/html/issues/4001#issuecomment-1423744502

annevk commented 1 year ago

cc @evilpie @mikewest @youennf

evilpie commented 1 year ago

We don't have any telemetry in Firefox for importScripts or new Worker with data:, blob: etc. with non JS MIME types, so that would be best to add first.

evilpie commented 1 year ago

Probably not a deal breaker, but this caused a regression in emscripten: https://github.com/emscripten-core/emscripten/issues/19080 (https://bugzilla.mozilla.org/show_bug.cgi?id=1824839)