Re: [ServiceWorker] Should window.caches be removed (or readonly) for security reasons? (#698)

wouldn't an XSS be able to bypass the CSP storage restrictions with URL.createObjectURL(new Blob(['<script>caches.keys().then(keys => keys.map(key => caches.open(key).then(cache => cache.add(new Request('/'), new Response(new Blob(["<script>attack<\/script>"], {type: "text/html"}))))))</script>'])) or something like that

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/698#issuecomment-106566412