Re: [ServiceWorker] ServiceWorker scriptURL XSS Filtering (#743)

The [`<platinum-sw>`](https://github.com/PolymerElements/platinum-sw) Polymer service worker library relies on customizing the search/query string of the service worker script URL to configure the behavior of the underlying service worker. Most of the query parameter names are also strings found in the underlying service worker script, since the script deserializes the parameters based on name.

I don't believe that any of the query string parameter names are currently over 20 bytes in length, so my understanding is that this restriction wouldn't cause issues as it's currently planned. But if that 20 bytes ever decreases down to a smaller length, I could imagine there would be unexpected failures.

To see the `<platinum-sw>` behavior in action, you can visit the [demo page](https://polymerelements.github.io/platinum-sw/components/platinum-sw/demo/) and then take a look at the URL of the resulting service worker that is registered.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/743#issuecomment-136733445