Set wasm-unsafe-eval in CSP?

[twschiller]

Context

• Inconsistency: Default content_security_policy w3c/webextensions#98 (comment)
• Our jq brick uses a WASM module? Or is Ecmascripten not impacted? https://github.com/fiatjaf/jq-web
• Do we need to set a wasm related key in our CSP? Do we have a risk of breaking in future versions of Chrome?

@fregante could you help look into this?

[fregante]

emscripten is that tool that compiles into WebAssembly (AKA Wasm), so yes in theory it does affect us.

From what I understand, they're adding a wasm-specific unsafe-eval key so that you can enable unsafe-eval for exclusively Wasm, but not JavaScript. The motivation paragraph here should be clear on this:

• https://chromestatus.com/feature/5499765773041664

Since we already have an all-encompassing unsafe-eval, we don't need to specify the wasm-unsafe-eval subset.

If unsafe-eval were to be disabled in MV3, then we'll be able to switch to wasm-unsafe-eval