Hello Webkit devs We would like to get an official position on this proposal.
Currently, CSP has an option to manage policy for WebAssembly execution through the 'unsafe-eval' source directive. However, the primary role of that directive is to allow eval in JavaScript.
This change adds a specific source directive 'wasm-unsafe-eval' to CSP that permits an engine to compile and instantiate a wasm module. In addition, the proposal is to extend the coverage of existing script-src directives to include wasm modules downloaded using the fetch API. This would affect instantiateStreaming and compileStreaming.
Thank you
Francis McCabe