27852 2015-01-19 11:41:42 +0000 Consider rejecting script responses whose MIME type isn't sufficiently scripty. 2016-03-24 13:53:25 +0000 1 1 1 Unclassified WHATWG HTML unspecified PC Linux RESOLVED MOVED https://bugzilla.mozilla.org/show_bug.cgi?id=1103360 http://code.google.com/p/chromium/issues/detail?id=433049 P2 normal Needs Research 1 mkwst d annevk d hsivonen ian mike mkwst contributor oldest_to_newest 117308 0 mkwst 2015-01-19 11:41:42 +0000 https://crbug.com/433049 changes Chrome's behavior to reject scripts whose MIME type is `image/*`. If this doesn't Break The Internet, we should consider changing the spec to match (and deciding on other types which might be blockable in the same way (audio/video/etc). 117309 1 annevk 2015-01-19 11:53:53 +0000 This should happen in HTML, no? 117313 2 hsivonen 2015-01-19 13:04:16 +0000 (In reply to Anne from comment #1) > This should happen in HTML, no? The spec that Chrome now violates is HTML, yes. 117314 3 mkwst 2015-01-19 13:04:49 +0000 Maybe? Changing components, CCing hixie. 117432 4 ian 2015-01-22 17:02:56 +0000 Please change the Target Milestone on this bug to Unsorted once we have information on how compatible this is. Thanks! 123018 5 annevk 2015-09-02 09:09:29 +0000 What we need to do here: * Share fetching logic for <script>, importScripts(), new Worker, new SharedWorker() * Ban image/* responses (act as network error) Probably best as two distinct changes. 123019 6 annevk 2015-09-02 09:09:53 +0000 And then convince <svg:script> to use the same "script fetch" hook. 124692 7 d 2016-01-24 05:40:16 +0000 Mike, it sounds like https://code.google.com/p/chromium/issues/detail?id=433049 did end up landing, right? Can you confirm that it's the same blocking for <script>, importScripts, new Worker, and new SharedWorker? Or is it just <script>? I'm happy to take this, although maybe if it ends up being blocked in all those places it'll be better over in Fetch... 125614 8 mkwst 2016-03-24 13:35:06 +0000 Poking at this in https://github.com/whatwg/fetch/pull/261.