258443 2023-06-23 00:43:18 -0700 Blob can't be read from opaque origined Workers 2023-10-18 04:30:14 -0700 1 1 1 Unclassified WebKit WebCore Misc. Safari Technology Preview Mac (Apple Silicon) macOS 13 NEW https://bugs.webkit.org/show_bug.cgi?id=244862 https://bugs.webkit.org/show_bug.cgi?id=243996 InRadar P2 Normal --- 1 tristan.fraipont webkit-unassigned annevk cdumez kurt webkit-bug-importer oldest_to_newest 1963246 0 tristan.fraipont 2023-06-23 00:43:18 -0700 Test-case: https://codepen.io/_-0-_/pen/qBQqbLy Trying to read a Blob object with whatever method (`.arrayBuffer()` et al., `FileReader`, `new Response(blob).arrayBuffer()` etc.) from an opaque origin Web Worker throws an error: > [Error] Not allowed to load local resource: blob:null/70ccdfb9-8d83-4234-aec5-c45cb251b792 > [Error] Cannot load blob:null/70ccdfb9-8d83-4234-aec5-c45cb251b792 due to access control checks. > [Error] Failed to load resource: Not allowed to request resource (70ccdfb9-8d83-4234-aec5-c45cb251b792, line 0) > [Error] Unhandled Promise Rejection: NotReadableError: The I/O read operation failed. (anonymous function) (data:text/javascript,%0A…%0A:3) The issue seems to be that the fetch request made to access the blob's data goes through cross-origin checks, however the Blob should be by essence same origin, since it's supposed to be "in memory". This happens for Workers created from a data: URL, as well as for the ones created from a blob: URL in a file:// document. The weird thing is that it seems to work fine for opaque origin iframes (sandboxed or data: URL). 1964420 1 webkit-bug-importer 2023-06-30 00:44:16 -0700 <rdar://problem/111555365>