Re: [ServiceWorker] ServiceWorker scriptURL XSS Filtering (#743)

> I don't believe that any of the query string parameter names are currently over 20 bytes in length, so my understanding is that this restriction wouldn't cause issues as it's currently planned. But if that 20 bytes ever decreases down to a smaller length, I could imagine there would be unexpected failures.

If I understand correctly the concern is more about the query string values, not the names.  For example, the original POC linked creates a SW scriptURL like:

  https://clientsit.herokuapp.com/jsonp?callback=onfetch%3Dfunction(e)%7B%0Ae.respondWith(new%20Response(%27%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E%27%2C%7Bheaders%3A%20%7B%27Content-Type%27%3A%27text%2Fhtml%27%7D%7D))%0A%7D%2F%2F

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/743#issuecomment-136735591