Created attachment 572019 [details] [diff] [review]
We should allow data URLs to make workers. Patch attached.
*** Bug 700626 has been marked as a duplicate of this bug. ***
Why we are going to allow data URL Workers while the spec explicitly disallows?
Is a spec change proposed somewhere? If it is, please let me know the pointer.
I don't mind allowing in itself so much because we (and even Chrome) already allow Blob URL Workers.
In Gecko data-urls have always been considered same-origin, so in a way we are actually complying with the spec.
The origin of data urls is something that is still being debated in the spec world, so I don't think we should make a departure from our usual behavior here.
(In reply to Jonas Sicking (:sicking) from comment #6)
> In Gecko data-urls have always been considered same-origin, so in a way we
> are actually complying with the spec.
"origin" definition of HTML spec is:
| The term origin is used per its definition in the Origin specification.
And in the Origin specification, data URIs are defined as "globally unique identifiers" and cannot be same-origin with any domains.
| A globally unique identifier is a value which is different from all
| other previously existing values. For example, a sufficiently long
| random string is likely to be a globally unique identifier.
| data URIs do not use a server-based naming authority and therefore have
| globally unique identifiers as origins.
So I think it's better to update the spec.
The draft has been expired in May 30, 2011.
I've updated :
I did mention the disagreement about whether a data URI is valid under the same-origin policy or not.
I didn't made any changes to https://developer.mozilla.org/en/data_URIs as we don't list any usage there.
Is there a bug opened at the WhatWG/W3C to fix the documentation to explicitly allow dataURI? It would be helpful for me to follow it to know if/when the specs are changed to update the doc w/ this information.