This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 27852 - Consider rejecting script responses whose MIME type isn't sufficiently scripty.
Summary: Consider rejecting script responses whose MIME type isn't sufficiently scripty.
Status: RESOLVED MOVED
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: PC Linux
: P2 normal
Target Milestone: Needs Research
Assignee: Domenic Denicola
QA Contact: contributor
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-19 11:41 UTC by Mike West
Modified: 2016-03-24 13:53 UTC (History)
6 users (show)

See Also:

Attachments

Description Mike West 2015-01-19 11:41:42 UTC 
https://crbug.com/433049 changes Chrome's behavior to reject scripts whose MIME type is `image/*`. If this doesn't Break The Internet, we should consider changing the spec to match (and deciding on other types which might be blockable in the same way (audio/video/etc).
Comment 1 Anne 2015-01-19 11:53:53 UTC 
This should happen in HTML, no?
Comment 2 Henri Sivonen 2015-01-19 13:04:16 UTC 
(In reply to Anne from comment #1)
> This should happen in HTML, no?

The spec that Chrome now violates is HTML, yes.
Comment 3 Mike West 2015-01-19 13:04:49 UTC 
Maybe? Changing components, CCing hixie.
Comment 4 Ian 'Hixie' Hickson 2015-01-22 17:02:56 UTC 
Please change the Target Milestone on this bug to Unsorted once we have information on how compatible this is. Thanks!
Comment 5 Anne 2015-09-02 09:09:29 UTC 
What we need to do here:

* Share fetching logic for <script>, importScripts(), new Worker, new SharedWorker()
* Ban image/* responses (act as network error)

Probably best as two distinct changes.
Comment 6 Anne 2015-09-02 09:09:53 UTC 
And then convince <svg:script> to use the same "script fetch" hook.
Comment 7 Domenic Denicola 2016-01-24 05:40:16 UTC 
Mike, it sounds like https://code.google.com/p/chromium/issues/detail?id=433049 did end up landing, right? Can you confirm that it's the same blocking for <script>, importScripts, new Worker, and new SharedWorker? Or is it just <script>?

I'm happy to take this, although maybe if it ends up being blocked in all those places it'll be better over in Fetch...
Comment 8 Mike West 2016-03-24 13:35:06 UTC 
Poking at this in https://github.com/whatwg/fetch/pull/261.