Re: [css-houdini-drafts] Ban data URL worklets (#985)

• From: CSS Meeting Bot via GitHub <sysbot+gh@w3.org>
• Date: Fri, 31 Jul 2020 17:38:41 +0000
• To: public-houdini-archive@w3.org
• Message-ID: <issue_comment.created-667246902-1596217119-sysbot+gh@w3.org>

The CSS Working Group just discussed `ban data: url worklets`, and agreed to the following:

* `RESOLVED: ban data url from spanning a worker`

<details><summary>The full IRC log of that discussion</summary>
&lt;TabAtkins> Topic: ban data: url worklets<br>
&lt;TabAtkins> github: https://github.com/w3c/css-houdini-drafts/issues/985<br>
&lt;fremy> TabAtkins: next topic comes from Ana Tudor<br>
&lt;AmeliaBR> s/Ana Tudor/Anne VK/<br>
&lt;fremy> s/Ana Tudor/AnneVK/<br>
&lt;TabAtkins> vK<br>
&lt;fremy> TabAtkins: you initialize a worklet by passing a url<br>
&lt;fremy> TabAtkins: you can do that using a data url to avoid using the network<br>
&lt;fremy> TabAtkins: annevk says that this can be an issue<br>
&lt;fremy> TabAtkins: for security reasons<br>
&lt;fremy> TabAtkins: blob urls would still work<br>
&lt;fremy> TabAtkins: but data urls apparently have some issue<br>
&lt;fremy> TabAtkins: any comment?<br>
&lt;fremy> AmeliaBR: can we add a note showing how to use a blob url?<br>
&lt;fremy> TabAtkins: why not?<br>
&lt;fremy> TabAtkins: any suggestion?<br>
&lt;fremy> RESOLVED: ban data url from spanning a worker<br>
&lt;fremy> s/spanning/spawning/<br>
</details>


-- 
GitHub Notification of comment by css-meeting-bot
Please view or discuss this issue at https://github.com/w3c/css-houdini-drafts/issues/985#issuecomment-667246902 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 31 July 2020 17:38:43 UTC