Re: [ServiceWorker] Passing a scope or scriptURL to register() with escaped '/' or '\ should fail (#630)

(hit enter too early)

Depending on the server configuration, it's possible for someone to easily break the path restriction: put a script at /users/~mattto/sw.js then register('/', '/users%2f~mattto%2fsw.js') passes is accepted.

Of course, the path restriction is inherently not very secure, but this happened in the wild and Chrome now rejects register() calls escaped slashes in scope or scriptURL.


---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/630#issuecomment-75199693