You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the current specification, it's mentioned that WebAssembly is only integrated with the unsafe-eval and wasm-unsafe-eval stanza for script-src.
Separately, there is also a mode of CSP known as strict-dynamic which allows trust to be given specifically to certain scripts which then carry that trust to (mostly) anything else they would execute dynamically.
Today it seems like this trust is extended to both scripts and worker generated by the initial trusted script but crucially not to WebAssembly code that is attempted to be instantiated from a trust script in this way.
Is this a desired aspect of the specification or something to fix?
The text was updated successfully, but these errors were encountered:
In the current specification, it's mentioned that WebAssembly is only integrated with the
unsafe-eval
andwasm-unsafe-eval
stanza forscript-src
.Separately, there is also a mode of CSP known as
strict-dynamic
which allows trust to be given specifically to certain scripts which then carry that trust to (mostly) anything else they would execute dynamically.Today it seems like this trust is extended to both scripts and worker generated by the initial trusted script but crucially not to WebAssembly code that is attempted to be instantiated from a trust script in this way.
Is this a desired aspect of the specification or something to fix?
The text was updated successfully, but these errors were encountered: