699857 - Workers: Allow data urls

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

We should allow data URLs to make workers. Patch attached.

Comment 1

[Ben Turner (not reading bugmail, use the needinfo flag!)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/dc3fa66976e6

Comment 2

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/dc3fa66976e6

Comment 5

[Masatoshi Kimura [:emk]]

Why we are going to allow data URL Workers while the spec explicitly disallows?
http://dev.w3.org/html5/workers/#handler-worker-onmessage
Is a spec change proposed somewhere? If it is, please let me know the pointer.
I don't mind allowing in itself so much because we (and even Chrome) already allow Blob URL Workers.

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

In Gecko data-urls have always been considered same-origin, so in a way we are actually complying with the spec.

The origin of data urls is something that is still being debated in the spec world, so I don't think we should make a departure from our usual behavior here.

Comment 7

[dynamis (Tomoya ASAI)]

(In reply to Jonas Sicking (:sicking) from comment #6)
> In Gecko data-urls have always been considered same-origin, so in a way we
> are actually complying with the spec.

"origin" definition of HTML spec is:
https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#terminology
| The term origin is used per its definition in the Origin specification.

And in the Origin specification, data URIs are defined as "globally unique identifiers" and cannot be same-origin with any domains.
http://tools.ietf.org/html/draft-abarth-origin-09#section-2.3
| A globally unique identifier is a value which is different from all
| other previously existing values.  For example, a sufficiently long
| random string is likely to be a globally unique identifier.
http://tools.ietf.org/html/draft-abarth-origin-09#section-4
| data URIs do not use a server-based naming authority and therefore have
| globally unique identifiers as origins.

So I think it's better to update the spec.

Comment 8

[Masatoshi Kimura [:emk]]

The draft has been expired in May 30, 2011.

Comment 9

[Jean-Yves Perrier [:teoli]]

I've updated :
https://developer.mozilla.org/En/DOM/Worker
https://developer.mozilla.org/En/Using_web_workers and
https://developer.mozilla.org/en/Firefox_10_for_developer

I did mention the disagreement about whether a data URI is valid under the same-origin policy or not.

I didn't made any changes to https://developer.mozilla.org/en/data_URIs as we don't list any usage there.

Is there a bug opened at the WhatWG/W3C to fix the documentation to explicitly allow dataURI? It would be helpful for me to follow it to know if/when the specs are changed to update the doc w/ this information.