[whatwg/fetch] Treat data URLs as same-origin, except for workers (#387)

HTML gives data URLs a unique origin when navigating to them to prevent
a class of XSS attacks.

Since browsers already largely allow data URLs in all other contexts
this commit aligns with that, opting them into being same-origin
elsewhere.

Workers however are still prevented. It would create problems for
shared workers and potentially also for dedicated workers.

Fixes #381.
You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/387

-- Commit Summary --

  * Treat data URLs as same-origin, except for workers

-- File Changes --

    M Overview.html (14)
    M Overview.src.html (14)

-- Patch Links --

https://github.com/whatwg/fetch/pull/387.patch
https://github.com/whatwg/fetch/pull/387.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/387