Bug 192749 - Consider strictly enforcing MIME checks for Workers.
Summary: Consider strictly enforcing MIME checks for Workers.
Status: RESOLVED DUPLICATE of bug 236411
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-12-17 00:58 PST by Mike West
Modified: 2022-07-05 14:00 PDT (History)
8 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mike West 2018-12-17 00:58:41 PST 
After discussion in https://github.com/whatwg/html/issues/3255 and https://github.com/whatwg/html/pull/4001, Chrome is shipping strict MIME type checks on `importScripts()` in Chrome 71 (https://chromium-review.googlesource.com/c/chromium/src/+/1206270). Intent to Remove thread with discussion and data at https://groups.google.com/a/chromium.org/d/msg/blink-dev/35t5cJQ3J_Q/FH45dl0vAwAJ.

It would be lovely if y'all followed suit!
Comment 1 Radar WebKit Bug Importer 2018-12-20 17:48:44 PST 
<rdar://problem/46889296>
Comment 2 Mike West 2019-11-18 01:44:06 PST 
Chrome and Firefox shipped restrictions on `importScripts()` a little while back.

We're now both aiming to tighten it to `new {Shared,Service,}Worker()` as well. Perhaps y'all could weigh in, one way or another, on https://github.com/whatwg/html/issues/3255?
Comment 3 Brent Fulgham 2019-11-18 09:04:55 PST 
On the surface this seems like a good change. We will definitely dig into this asap!
Comment 4 Domenic Denicola 2020-08-12 14:57:34 PDT 
We've now merged the second stage of this into the HTML spec: adding MIME type checks for HTTP(S) worker scripts. See https://github.com/whatwg/html/pull/5302 and the corresponding tests pull request in https://github.com/web-platform-tests/wpt/pull/24983. Firefox is shipping shortly.

data: and blob: URL workers are still not checked.
Comment 5 Sam Sneddon [:gsnedders] 2022-07-05 14:00:07 PDT 

*** This bug has been marked as a duplicate of bug 236411 ***