Re: [whatwg/fetch] Should fetches to blob URLs be more restricted? (#666)

I've been trying to write tests, yes. And the situation (at least in chrome) is fairly complicated. What I've figured out so far:

- Chrome does block no-cors fetches to blob: URLs in img tags etc, but does not block no-cors fetches via the fetch API (but of course then you can't do much with those opaque responses, since using those responses still ends up getting blocked). Firefox blocks all no-cors requests I've been able to come up with so far.

- For navigate requests it's also complicated. Chrome blocks most of these requests, except for noopener window.open. In that case chrome does seem to let the request go through. And I'm sure there's plenty of permutations of variables I haven't tried yet, so I'm not sure what exactly Chrome currently does or doesn't block...

I'll work on cleaning up my tests a bit more and trying to add more cases/see what other browsers are doing.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/666#issuecomment-362026981