1455077 - investigate where service worker code should call NS_CheckContentLoadPolicy()

Status: NEW

(Core :: DOM: Service Workers, enhancement, P3)

Description

[Ben Kelly [:bkelly, not reviewing]]

Currently we call NS_CheckContentLoadPolicy() explicitly in ServiceWorkerContainer::Register().  In some ways this is unnecessary since we also check this via AsyncOpen2() when first downloading the script.  In other ways its not enough because we don't check the content policy when loading a previously offlined script to spawn a service worker thread.

We should investigate what policy we actually want and move the checks to the right place.

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

The existing NS_CheckContentLoadPolicy() stuff was added in bug 1208559.  Note, there is still an open spec issue from this:

https://github.com/w3c/ServiceWorker/issues/755

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

And the reason we have the ServiceWorkerContainer::Register() check is to validate CSP.  This is tested in:

  dom/security/test/csp/test_service_worker.html

Unfortunately this needs a document so we have to trust the content process to do it.