[webkit-reviews] review granted: [Bug 219166] Unable to fetch an audio worklet module using a data URL : [Attachment 414597] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Thu Nov 19 11:05:54 PST 2020


youenn fablet <youennf at gmail.com> has granted Chris Dumez <cdumez at apple.com>'s
request for review:
Bug 219166: Unable to fetch an audio worklet module using a data URL
https://bugs.webkit.org/show_bug.cgi?id=219166

Attachment 414597: Patch

https://bugs.webkit.org/attachment.cgi?id=414597&action=review




--- Comment #4 from youenn fablet <youennf at gmail.com> ---
Comment on attachment 414597
  --> https://bugs.webkit.org/attachment.cgi?id=414597
Patch

r=me once we verify there is no issue with the origin of audio worklet for data
URLs.

View in context: https://bugs.webkit.org/attachment.cgi?id=414597&action=review

>>> Source/WebCore/workers/WorkerScriptLoader.cpp:133
>>> +	     options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
>> 
>> I tried to think through why the same origin restriction is only required
for ServiceWorker and Worker, but I couldn't figure it out. What's the
distinction being made here?
> 
> I am not sure this is correct. I am not sure what's the best condition to use
and I asked Youenn for feedback on Slack (He said he would look at it shortly).
> 
> The flag in question has been dropped from the spec:
> https://github.com/whatwg/fetch/issues/381

Ideally, we should remove this flag and have specific handling for navigation
loads and for dedicated workers.
For dedicated workers, the current approach is to do the following as per spec:
set worker global scope's cross-origin isolated capability to false.
I am not sure what is the rationale here. For audio worklet, how do we compute
the origin of the audio worklet?

For service workers, there is no point in setting the same origin flag, we
should fail any data: load whose destination is service worker.
In fact, we should not even hit that code path since the register method should
reject on data: URL schemes.

For this specific patch, we could just keep the if (fetchOptions.destination !=
FetchOptions::Destination::Worker) for now with a FIXME stating to remove this
flag and implement the spec.


More information about the webkit-reviews mailing list