192749 2018-12-17 00:58:41 -0800 Consider strictly enforcing MIME checks for Workers. 2022-07-05 14:00:07 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 236411 InRadar P2 Normal --- 1 mkwst webkit-unassigned achristensen ap bfulgham cdumez d webkit-bug-importer wilander youennf oldest_to_newest 1488403 0 mkwst 2018-12-17 00:58:41 -0800 After discussion in https://github.com/whatwg/html/issues/3255 and https://github.com/whatwg/html/pull/4001, Chrome is shipping strict MIME type checks on `importScripts()` in Chrome 71 (https://chromium-review.googlesource.com/c/chromium/src/+/1206270). Intent to Remove thread with discussion and data at https://groups.google.com/a/chromium.org/d/msg/blink-dev/35t5cJQ3J_Q/FH45dl0vAwAJ. It would be lovely if y'all followed suit! 1490229 1 webkit-bug-importer 2018-12-20 17:48:44 -0800 <rdar://problem/46889296> 1591007 2 mkwst 2019-11-18 01:44:06 -0800 Chrome and Firefox shipped restrictions on `importScripts()` a little while back. We're now both aiming to tighten it to `new {Shared,Service,}Worker()` as well. Perhaps y'all could weigh in, one way or another, on https://github.com/whatwg/html/issues/3255? 1591065 3 bfulgham 2019-11-18 09:04:55 -0800 On the surface this seems like a good change. We will definitely dig into this asap! 1679840 4 d 2020-08-12 14:57:34 -0700 We've now merged the second stage of this into the HTML spec: adding MIME type checks for HTTP(S) worker scripts. See https://github.com/whatwg/html/pull/5302 and the corresponding tests pull request in https://github.com/web-platform-tests/wpt/pull/24983. Firefox is shipping shortly. data: and blob: URL workers are still not checked. 1880793 5 gsnedders 2022-07-05 14:00:07 -0700 *** This bug has been marked as a duplicate of bug 236411 ***