Re: [css-houdini-drafts] Ban data URL worklets (#985)

There is definitely a strong use case for having some way to keep simple module code encapsulated in the same file as the registration script, just to minimize the number of files (and fetches) required for something like a simple CSS Paint worklet.

But if Blob URLs are still OK, that could replace it. The WPT worklet tests all seem to use this pattern.  If you disallow data URLs, it might be worth including an example of how to generate a blob URL from a string.

(Note, I don't quite understand how Blobs are different from data URLs when it comes to the security issues, but if it works, it works! Just make sure it's clear in the spec.)

-- 
GitHub Notification of comment by AmeliaBR
Please view or discuss this issue at https://github.com/w3c/css-houdini-drafts/issues/985#issuecomment-620751959 using your GitHub account

Received on Tuesday, 28 April 2020 17:36:26 UTC