Re: [css-houdini-drafts] Ban data URL worklets (#985)

The main point of this issue is that a data URL worklets have an opaque origin, right?

Top-level worklet script import and static import from there are issued with the outside settings object (i.e., window) as the fetch client, not the inside settings object (i.e., worklet global scope), so I guess the origin of the worklet shouldn't affect them (double-check is needed). Also, data URL worklets wouldn't be able to run static import because the top-level data URL module script doesn't have a valid base URL and cannot resolve a module identifier for static import.

-- 
GitHub Notification of comment by nhiroki
Please view or discuss this issue at https://github.com/w3c/css-houdini-drafts/issues/985#issuecomment-620476103 using your GitHub account

Received on Tuesday, 28 April 2020 08:59:46 UTC