content-security-policy
content-security-policy copied to clipboard
Published
20 hours ago •
WebAssembly
WebAssembly
Extending WASM CSP to be covered under `strict-dynamic`
In the current specification, it's mentioned that WebAssembly is only integrated with the unsafe-eval and wasm-unsafe-eval stanza for script-src.
Separately, there is also a mode of CSP known as strict-dynamic which allows trust to be given specifically to certain scripts which then carry that trust to (mostly) anything else they would execute dynamically.
Today it seems like this trust is extended to both scripts and worker generated by the initial trusted script but crucially not to WebAssembly code that is attempted to be instantiated from a trust script in this way.
Is this a desired aspect of the specification or something to fix?
