Bug 258443
| Summary: | Blob can't be read from opaque origined Workers | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Kaiido <tristan.fraipont> |
| Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | annevk, cdumez, kurt, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Safari Technology Preview | ||
| Hardware: | Mac (Apple Silicon) | ||
| OS: | macOS 13 | ||
| See Also: |
https://bugs.webkit.org/show_bug.cgi?id=244862 https://bugs.webkit.org/show_bug.cgi?id=243996 |
||
Kaiido
Test-case: https://codepen.io/_-0-_/pen/qBQqbLy
Trying to read a Blob object with whatever method (`.arrayBuffer()` et al., `FileReader`, `new Response(blob).arrayBuffer()` etc.) from an opaque origin Web Worker throws an error:
> [Error] Not allowed to load local resource: blob:null/70ccdfb9-8d83-4234-aec5-c45cb251b792
> [Error] Cannot load blob:null/70ccdfb9-8d83-4234-aec5-c45cb251b792 due to access control checks.
> [Error] Failed to load resource: Not allowed to request resource (70ccdfb9-8d83-4234-aec5-c45cb251b792, line 0)
> [Error] Unhandled Promise Rejection: NotReadableError: The I/O read operation failed. (anonymous function) (data:text/javascript,%0A…%0A:3)
The issue seems to be that the fetch request made to access the blob's data goes through cross-origin checks, however the Blob should be by essence same origin, since it's supposed to be "in memory".
This happens for Workers created from a data: URL, as well as for the ones created from a blob: URL in a file:// document.
The weird thing is that it seems to work fine for opaque origin iframes (sandboxed or data: URL).
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/111555365>