1847548 - Worker's dynamic import scripts should have different content policy types than worker's static import scripts.

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Currently worker's dynamic import scripts are using the the content policy type nsIContentPolicy::TYPE_INTERNAL_WORKER_STATIC_MODULE, which is wrong.

Comment 1

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1847548 - Part 1: Use nsIContentPolicy::TYPE_INTERNAL_MODULE for worker's dynamic import scripts.

For dynamic import, its destination is "script".
See https://html.spec.whatwg.org/multipage/webappapis.html#hostloadimportedmodule,
step 10.
Let destination be "script".

According to the destination table in HTML spec.
https://fetch.spec.whatwg.org/#destination-table
We can reuse the existing content policy type TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS
for worker's dynamic import scripts, without creating a new one for it.

Comment 2

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1847548 - Part 3: Update ini files in WPT/.

Comment 3

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1847548 - Part 1: Add csp type TYPE_INTERNAL_WORKER_DYNAMIC_IMPORT_SCRIPT.

For dynamic import, its destination is "script".
See https://html.spec.whatwg.org/multipage/webappapis.html#hostloadimportedmodule,
step 10.
Let destination be "script".

Comment 4

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1847548 - Part 2: Add a CSP test 'script-src-elem' for worker's static import and dynamic import.

Comment 5

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1847548 - Part 1: Update comments of INTERNAL_MODULE in nsIContentPoliccy.idl.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cfb6d2f457db
Part 1: Use nsIContentPolicy::TYPE_INTERNAL_MODULE for worker's dynamic import scripts. r=dom-worker-reviewers,smaug,evilpie
https://hg.mozilla.org/integration/autoland/rev/c2b0f04c34d3
Part 2: Add a CSP test 'script-src-elem' for worker's static import and dynamic import. r=evilpie,dom-worker-reviewers,smaug
https://hg.mozilla.org/integration/autoland/rev/a229f36ddd39
Part 3: Update ini files in WPT/. r=dom-worker-reviewers,smaug

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/41466 for changes under testing/web-platform/tests

Comment 8

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/cfb6d2f457db
https://hg.mozilla.org/mozilla-central/rev/c2b0f04c34d3
https://hg.mozilla.org/mozilla-central/rev/a229f36ddd39

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot