Intent to Prototype: WebAssembly Content Security Policy

61 views
Skip to first unread message

Francis McCabe

unread,
Sep 1, 2021, 3:00:07 PM9/1/21
to blin...@chromium.org

Contact emails

ad...@chromium.org
f...@chromium.org

Explainer

https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md

Specification

https://github.com/w3c/webappsec-csp/pull/293

Summary

Enhancements to Content Security Policy to improve interoperability with WebAssembly.



Blink component

Blink

Motivation

Allows web developers to be more fine grained in their policy wrt executing WebAssembly. Currently, if there is a non-empty CSP policy for a page, the unsafe-eval policy must be enabled. This allows a developer to use wasm-unsafe-eval that only allows webassembly execution and has no impact on javaScript execution. In addition, the proposal is to extend existing CSP script-src policies to include webassembly. Since WebAssembly does not have an element tag, this will be, initially, to apply script-src policies to the relevant API calls: WebAssembly.instantiateStreaming etc.



Initial public proposal

https://github.com/w3c/webappsec-csp/pull/293

Search tags

wasm, webassembly, csp

TAG review

Not needed

TAG review status



Risks



Interoperability and Compatibility



Gecko: 


Debuggability



Is this feature fully tested by web-platform-tests?

Yes

Flag name



Requires code in //chrome?

False 

Tracking bug

https://bugs.chromium.org/p/chromium/issues/detail?id=841404

Estimated milestones



Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5499765773041664

This intent message was generated by Chrome Platform Status.

Yoav Weiss

unread,
Sep 2, 2021, 9:43:36 AM9/2/21
to Francis McCabe, blink-dev
On Wed, Sep 1, 2021 at 9:00 PM Francis McCabe <f...@chromium.org> wrote:

Contact emails

ad...@chromium.org
f...@chromium.org

Explainer

https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md

Specification

https://github.com/w3c/webappsec-csp/pull/293

Summary

Enhancements to Content Security Policy to improve interoperability with WebAssembly.



Blink component

Blink

Motivation

Allows web developers to be more fine grained in their policy wrt executing WebAssembly. Currently, if there is a non-empty CSP policy for a page, the unsafe-eval policy must be enabled. This allows a developer to use wasm-unsafe-eval that only allows webassembly execution and has no impact on javaScript execution. In addition, the proposal is to extend existing CSP script-src policies to include webassembly. Since WebAssembly does not have an element tag, this will be, initially, to apply script-src policies to the relevant API calls: WebAssembly.instantiateStreaming etc.



Initial public proposal

https://github.com/w3c/webappsec-csp/pull/293

Search tags

wasm, webassembly, csp

TAG review

Not needed

Can you expand on why you think a TAG review is not needed?
 

TAG review status



Risks



Interoperability and Compatibility



Gecko: 


Debuggability



Is this feature fully tested by web-platform-tests?

Yes

Flag name



Requires code in //chrome?

False 

Tracking bug

https://bugs.chromium.org/p/chromium/issues/detail?id=841404

Estimated milestones



Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5499765773041664

This intent message was generated by Chrome Platform Status.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAE65UWB-%3DsKJUpiXcZ2jBGZaQ_yAXWOUdO2Jt1mKA3whP7ZqdA%40mail.gmail.com.

Francis McCabe

unread,
Sep 2, 2021, 12:05:21 PM9/2/21
to Yoav Weiss, blink-dev
The proposed change is very small and not 'architectural'. The proposal adds a new policy keyword to CSP and extends the role (slightly) of script-src itself.

Adam Klein

unread,
Sep 2, 2021, 2:55:07 PM9/2/21
to Francis McCabe, Yoav Weiss, blink-dev
One big note is that this thread was actually meant to be an "Intent to Ship". Would the API owners prefer a new thread to make that clear or can we shift this thread to be such an intent?

Comments-in-line re: TAG.

On Thu, Sep 2, 2021 at 9:05 AM Francis McCabe <f...@chromium.org> wrote:
The proposed change is very small and not 'architectural'. The proposal adds a new policy keyword to CSP and extends the role (slightly) of script-src itself.


On Thu, Sep 2, 2021 at 6:43 AM Yoav Weiss <yoav...@chromium.org> wrote:


On Wed, Sep 1, 2021 at 9:00 PM Francis McCabe <f...@chromium.org> wrote:

Contact emails

ad...@chromium.org
f...@chromium.org

Explainer

https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md

Specification

https://github.com/w3c/webappsec-csp/pull/293

Summary

Enhancements to Content Security Policy to improve interoperability with WebAssembly.



Blink component

Blink

Motivation

Allows web developers to be more fine grained in their policy wrt executing WebAssembly. Currently, if there is a non-empty CSP policy for a page, the unsafe-eval policy must be enabled. This allows a developer to use wasm-unsafe-eval that only allows webassembly execution and has no impact on javaScript execution. In addition, the proposal is to extend existing CSP script-src policies to include webassembly. Since WebAssembly does not have an element tag, this will be, initially, to apply script-src policies to the relevant API calls: WebAssembly.instantiateStreaming etc.



Initial public proposal

https://github.com/w3c/webappsec-csp/pull/293

Search tags

wasm, webassembly, csp

TAG review

Not needed

Can you expand on why you think a TAG review is not needed?

To give a little more background beyond Francis's answer, my take is that this change has already gotten good feedback & review from the WebAppSec & HTML folks who are the experts in this area, making a TAG review superfluous (given that CSP & Wasm are both pre-existing pieces of the platform).
 

Yoav Weiss

unread,
Sep 2, 2021, 3:47:21 PM9/2/21
to Adam Klein, Francis McCabe, blink-dev
A new intent would be better, thanks!
Reply all
Reply to author
Forward
0 new messages