Intent to Ship: Import Assertions and JSON Modules

679 views

Skip to first unread message

Daniel Clark

unread,

Mar 5, 2021, 5:46:00 PM3/5/21

to blin...@chromium.org, litt...@igalia.com, s...@google.com, ma...@google.com, cbr...@google.com, kou...@google.com, hiro...@google.com, dom...@google.com

Contact emails

dan...@microsoft.com

Explainer

https://github.com/tc39/proposal-import-assertions (for import assertions)

https://github.com/whatwg/html/issues/4315 (for JSON modules)

Specification

https://tc39.es/proposal-import-assertions/

https://tc39.es/proposal-json-modules/

https://github.com/whatwg/html/pull/5883 (import assertions HTML integration)

https://github.com/whatwg/html/pull/5658/ (import assertions + JSON modules HTML integration)

Summary

JSON modules allow statically importing JSON instead of consuming JSON dynamically through fetch(). JSON modules, like JavaScript modules, are fetched using “cors” mode and strict MIME type checking. They also share the module import syntax and participate in the module graph.

Import Assertions are an inline syntax for module import statements to pass on more information alongside the module specifier. With JSON modules, they are used to assert that the author expects to import JSON content in order to prevent unexpected script execution if a JavaScript response is instead received from the server.

Together, the syntax to import a JSON modules is:

import json from "./foo.json" assert { type: "json" };

Blink components

Blink>HTML>Script

Blink>DOM

Search tags

import assertions, import attributes, import conditions, JSON modules, CSS modules, HTML modules, JSON, Module, import, static, graph

TAG review

https://github.com/w3ctag/design-reviews/issues/535 (import assertions)

https://github.com/w3ctag/design-reviews/issues/375 (JSON modules)

TAG review status

Issues addressed

Risks

Interoperability and Compatibility

Given positive signals from other browser implementers we expect these features to have wide support across browser platforms.

Gecko:

Import Assertions: Positive (https://github.com/mozilla/standards-positions/issues/373) Worth prototyping

JSON Modules: Positive (https://github.com/whatwg/html/issues/4315#issuecomment-489537002)

WebKit:

Import Assertions: Positive

JSON Modules: No signal

Web developers:

Import Assertions: Positive

JSON Modules: Strongly positive (https://github.com/whatwg/html/issues/4315) There were many expressions of support in #4315. There were some requests in that thread to expand the feature to support named exports, but the due to the complexity and ambiguity involved this was not included.

Ergonomics

Import assertions will be used in tandem with new module types (JSON, CSS, HTML...), and may have additional future uses with module imports. Performance costs will be pay-for-play.

We expect JSON modules to be commonly used in tandem with JavaScript modules (and potentially other module types yet to come). The feature is built on Synthetic Modules as part of the existing module graph infrastructure so we don't expect any new performance issues.

Activation

Build tools and polyfills may be useful for adoption as import assertions and JSON modules roll out across various browser platform implementations.

Security

Import assertions are intended to address the security concern described in https://github.com/w3c/webcomponents/issues/839.

Aside from that, these features do not have any particular security concerns. See the TAG security and privacy review (https://github.com/tc39/proposal-import-assertions/blob/master/tag-security-and-privacy.md)

Debuggability

No special debuggability support needed.

Is this feature fully tested by web-platform-tests?

Test suites here:

https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/import-assertions

https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/json-module

Note, I plan to add further coverage along the lines of these suggestions: https://bugs.chromium.org/p/chromium/issues/detail?id=1132413#c15

Tracking bug

crbug.com/1132413, crbug.com/v8/10958 (import assertions)

crbug.com/964248 (JSON modules)

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5765269513306112 (import assertions)

https://chromestatus.com/feature/5749863620804608 (JSON modules)

Links to previous Intent discussions

Intent to prototype for import assertions (and ship, but that part of the request was rescinded at the time): https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/Xft04J07Oh0/m/RLPMXVEiAAAJ

Intent to implement for JSON modules: https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/ojwkySW-bpQ/m/Mo7POGPXAQAJ

Known issues

JSON modules are not yet implemented for ServiceWorkers. I plan to add ServiceWorker support in the coming weeks.

There is a known issue where parse errors are reported incorrectly for JSON modules: crbug.com/994315. However that there are similar issues for JS modules and other types of JSON parsing, so I’d prefer not to block on this. See notes in the bug.

Note on shipping jointly

In some sense these are two separate features, with separate feature flags, but I think it makes sense to ship them jointly because:

Import assertions don’t yet do anything useful without JSON modules.
JSON modules aren’t usable without JSON modules without opening them up to the security issue described at https://github.com/w3c/webcomponents/issues/839.

Alex Russell

unread,

Mar 8, 2021, 12:47:18 PM3/8/21

to blink-dev, Daniel Clark, litt...@igalia.com, Shu-yu Guo, ma...@google.com, cbr...@google.com, Kouhei Ueno, hiro...@google.com, Domenic Denicola

LGTM1

Thank you all for pushing this forward; I hope it's the first in a long line of new module types so that we can finally get back to a world where folks don't need to stuff resources into JS strings or wrangle huge toolchains at development time.

Mike West

unread,

Mar 9, 2021, 2:58:38 AM3/9/21

to Alex Russell, blink-dev, Daniel Clark, litt...@igalia.com, Shu-yu Guo, ma...@google.com, cbr...@google.com, Kouhei Ueno, hiro...@google.com, Domenic Denicola

LGTM2, since there's good evidence of support for import assertions (stage 3 in TC39), and the developer benefits of JSON modules seem clearly documented along with anecdotal evidence of other vendors' support. It would be ideal to use the official channels when gathering signals from other vendors, as noted inline below.

-mike

I agree that this is a positive comment! But, as https://bit.ly/blink-signals documents, the standards-positions repository is the right way to get Mozilla's "official standards position".

WebKit:

Import Assertions: Positive

JSON Modules: No signal

Can you link to the webkit-dev@ threads here?

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/f014310e-a3e3-4061-89bf-2c64e1d5f48en%40chromium.org.

Manuel Rego Casasnovas

unread,

Mar 10, 2021, 4:36:12 PM3/10/21

to Mike West, Alex Russell, blink-dev, Daniel Clark, litt...@igalia.com, Shu-yu Guo, ma...@google.com, cbr...@google.com, Kouhei Ueno, hiro...@google.com, Domenic Denicola

On 09/03/2021 08:58, Mike West wrote:
> LGTM2, since there's good evidence of support for import assertions
> (stage 3 in TC39), and the developer benefits of JSON modules seem
> clearly documented along with anecdotal evidence of other vendors'
> support. It would be ideal to use the official channels when gathering
> signals from other vendors, as noted inline below.

LGTM3, but I'm with Mike about the other vendors signals.

Cheers,
Rego

>
> -mike
>
>
> On Mon, Mar 8, 2021 at 6:47 PM 'Alex Russell' via blink-dev
> <blin...@chromium.org <mailto:blin...@chromium.org>> wrote:
>
> LGTM1
>
> Thank you all for pushing this forward; I hope it's the first in a
> long line of new module types so that we can finally get back to a
> world where folks don't need to stuff resources into JS strings or
> wrangle huge toolchains at development time.
>
> On Friday, March 5, 2021 at 2:46:00 PM UTC-8 Daniel Clark wrote:
>

> *Contact emails ____*
>
> dan...@microsoft.com____
>
> __ __
>
> *Explainer____*
>
> https://github.com/tc39/proposal-import-assertions
> <https://github.com/tc39/proposal-import-assertions> (for import
> assertions)____
>
> https://github.com/whatwg/html/issues/4315
> <https://github.com/whatwg/html/issues/4315> (for JSON modules)____
>
> __ __
>
> *Specification____*
>
> https://tc39.es/proposal-import-assertions/
> <https://tc39.es/proposal-import-assertions/>____
>
> https://tc39.es/proposal-json-modules/
> <https://tc39.es/proposal-json-modules/>____
>
> https://github.com/whatwg/html/pull/5883
> <https://github.com/whatwg/html/pull/5883> (import assertions
> HTML integration)____
>
> https://github.com/whatwg/html/pull/5658/

> <https://github.com/whatwg/html/pull/5658/> (import assertions +

> JSON modules HTML integration)____
>
> __ __
>
> *Summary____*

>
> JSON modules allow statically importing JSON instead of
> consuming JSON dynamically through fetch(). JSON modules, like
> JavaScript modules, are fetched using “cors” mode and strict
> MIME type checking. They also share the module import syntax and

> participate in the module graph.____
>
> __ __

>
> Import Assertions are an inline syntax for module import
> statements to pass on more information alongside the module
> specifier. With JSON modules, they are used to assert that the
> author expects to import JSON content in order to prevent
> unexpected script execution if a JavaScript response is instead

> received from the server.____
>
> __ __
>
> Together, the syntax to import a JSON modules is:____
>
> import json from "./foo.json" assert { type: "json" };____
>
> __ __
>
> *Blink components____*
>
> Blink>HTML>Script____
>
> Blink>DOM____
>
> __ __
>
> *Search tags____*

>
> import assertions, import attributes, import conditions, JSON
> modules, CSS modules, HTML modules, JSON, Module, import,

> static, graph____
>
> __ __
>
> *TAG review____*
>
> https://github.com/w3ctag/design-reviews/issues/535
> <https://github.com/w3ctag/design-reviews/issues/535> (import
> assertions)____
>
> https://github.com/w3ctag/design-reviews/issues/375
> <https://github.com/w3ctag/design-reviews/issues/375> (JSON
> modules)____
>
> __ __
>
> *TAG review status____*
>
> Issues addressed____
>
> __ __
>
> *Risks____*
>
> Interoperability and Compatibility____

>
> Given positive signals from other browser implementers we expect

> these features to have wide support across browser platforms.____
>
> __ __
>
> Gecko:____
>
> Import Assertions: Positive
> (https://github.com/mozilla/standards-positions/issues/373
> <https://github.com/mozilla/standards-positions/issues/373>)
> Worth prototyping____
>
> JSON Modules: Positive
> (https://github.com/whatwg/html/issues/4315#issuecomment-489537002
> <https://github.com/whatwg/html/issues/4315#issuecomment-489537002>)

>
>
> I agree that this is a positive comment! But, as

> https://bit.ly/blink-signals <https://bit.ly/blink-signals> documents,

> the standards-positions repository is the right way to get Mozilla's
> "official standards position".
>
>

> ____
>
> WebKit:____
>
> Import Assertions: Positive____

>
> JSON Modules: No signal
>
>
> Can you link to the webkit-dev@ threads here?
>
>

> ____
>
> Web developers:____
>
> Import Assertions: Positive____

>
> JSON Modules: Strongly positive
> (https://github.com/whatwg/html/issues/4315

> <https://github.com/whatwg/html/issues/4315>) There were many

> expressions of support in #4315. There were some requests in
> that thread to expand the feature to support named exports, but
> the due to the complexity and ambiguity involved this was not

> included.____
>
> __ __
>
> *Ergonomics____*

>
> Import assertions will be used in tandem with new module types
> (JSON, CSS, HTML...), and may have additional future uses with

> module imports. Performance costs will be pay-for-play.____

>
> We expect JSON modules to be commonly used in tandem with
> JavaScript modules (and potentially other module types yet to
> come). The feature is built on Synthetic Modules as part of the
> existing module graph infrastructure so we don't expect any new

> performance issues.____
>
> __ __
>
> *Activation____*

>
> Build tools and polyfills may be useful for adoption as import
> assertions and JSON modules roll out across various browser

> platform implementations.____
>
> __ __
>
> *Security____*

>
> Import assertions are intended to address the security concern
> described in https://github.com/w3c/webcomponents/issues/839

> <https://github.com/w3c/webcomponents/issues/839>.____

>
> Aside from that, these features do not have any particular
> security concerns. See the TAG security and privacy review
> (https://github.com/tc39/proposal-import-assertions/blob/master/tag-security-and-privacy.md

> <https://github.com/tc39/proposal-import-assertions/blob/master/tag-security-and-privacy.md>)____
>
> __ __
>
> *Debuggability____*
>
> No special debuggability support needed.____
>
> __ __
>
> *Is this feature fully tested by web-platform-tests?____*
>
> Test suites here:____
>
> https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/import-assertions
> <https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/import-assertions>____
>
> https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/json-module
> <https://github.com/web-platform-tests/wpt/tree/master/html/semantics/scripting-1/the-script-element/json-module>____

>
> Note, I plan to add further coverage along the lines of these
> suggestions:

> https://bugs.chromium.org/p/chromium/issues/detail?id=1132413#c15 <https://bugs.chromium.org/p/chromium/issues/detail?id=1132413#c15>____
>
> __ __
>
> *Tracking bug____*
>
> crbug.com/1132413 <http://crbug.com/1132413>, crbug.com/v8/10958
> <https://bugs.chromium.org/p/v8/issues/detail?id=10958> (import
> assertions) ____
>
> crbug.com/964248
> <https://bugs.chromium.org/p/chromium/issues/detail?id=964248>
> (JSON modules)____
>
> __ __
>
> *Link to entry on the Chrome Platform Status____*
>
> https://chromestatus.com/feature/5765269513306112
> <https://chromestatus.com/feature/5765269513306112> (import
> assertions)____
>
> https://chromestatus.com/feature/5749863620804608
> <https://chromestatus.com/feature/5749863620804608> (JSON
> modules)____
>
> __ __
>
> *Links to previous Intent discussions____*

>
> Intent to prototype for import assertions (and ship, but that
> part of the request was rescinded at the time):
> https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/Xft04J07Oh0/m/RLPMXVEiAAAJ

> <https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/Xft04J07Oh0/m/RLPMXVEiAAAJ>____

>
> Intent to implement for JSON modules:
> https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/ojwkySW-bpQ/m/Mo7POGPXAQAJ

> <https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/ojwkySW-bpQ/m/Mo7POGPXAQAJ>____
>
> *__ __*
>
> *Known issues____*

>
> JSON modules are not yet implemented for ServiceWorkers. I plan

> to add ServiceWorker support in the coming weeks.____

>
> There is a known issue where parse errors are reported
> incorrectly for JSON modules: crbug.com/994315

> <https://bugs.chromium.org/p/chromium/issues/detail?id=994315>.

> However that there are similar issues for JS modules and other
> types of JSON parsing, so I’d prefer not to block on this. See

> notes in the bug.____
>
> __ __
>
> *Note on shipping jointly____*

>
> In some sense these are two separate features, with separate
> feature flags, but I think it makes sense to ship them jointly

> because:____
>
> 1. Import assertions don’t yet do anything useful without JSON
> modules.____
> 2. JSON modules aren’t usable without JSON modules without

> opening them up to the security issue described at
> https://github.com/w3c/webcomponents/issues/839

> <https://github.com/w3c/webcomponents/issues/839>.____

>
> --
> You received this message because you are subscribed to the Google
> Groups "blink-dev" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to blink-dev+...@chromium.org

> <mailto:blink-dev+...@chromium.org>.

> To view this discussion on the web visit
> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/f014310e-a3e3-4061-89bf-2c64e1d5f48en%40chromium.org

> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/f014310e-a3e3-4061-89bf-2c64e1d5f48en%40chromium.org?utm_medium=email&utm_source=footer>.

>
> --
> You received this message because you are subscribed to the Google
> Groups "blink-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to blink-dev+...@chromium.org

> <mailto:blink-dev+...@chromium.org>.

> To view this discussion on the web visit

> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAKXHy%3DdLGxyrOJ%3D8TKC1ieAhs5vxS3jD_fDWSE9H%3DhwNMs2%3D7Q%40mail.gmail.com
> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAKXHy%3DdLGxyrOJ%3D8TKC1ieAhs5vxS3jD_fDWSE9H%3DhwNMs2%3D7Q%40mail.gmail.com?utm_medium=email&utm_source=footer>.

Daniel Clark

unread,

Mar 10, 2021, 5:58:22 PM3/10/21

to re...@igalia.com, mk...@chromium.org, sligh...@google.com, blin...@chromium.org, litt...@igalia.com, s...@google.com, ma...@google.com, cbr...@google.com, kou...@google.com, hiro...@google.com, dom...@google.com

Thanks everyone!

The JSON modules status entry https://chromestatus.com/feature/5749863620804608 has been updated to point to the relevant Mozilla standards-positions thread https://github.com/mozilla/standards-positions/issues/373#issuecomment-794416217. This is the same one as for import assertions because when Mozilla took that position, JSON modules was bundled together with import assertions in a single proposal. Yesterday I requested a clarification now that the proposals have been split. While they declined to create a separate standards-position entry, the directly linked comment is clear that the position from the original standards-position thread still reflects their position on JSON modules.

WebKit's review of these features happened in the WebKit Slack. I've requested with https://lists.webkit.org/pipermail/webkit-dev/2021-March/031725.html that their position be posted officially on WebKit-Dev, and I'll update the chromestatus entries when that's done.

-- Dan

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3ctag%2Fdesign-reviews%2Fissues%2F535&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078290882%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=f0PxWpY%2Fx5124bqOwP%2BI3DM1J7z4M%2Fec2CPHGA7P2OA%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3ctag%2Fdesign-reviews%2Fissues%2F535&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Yu7wryFsXotrlyyLY3X2uPz7t1USGGE84GIfObia4YM%3D&reserved=0> (import
> assertions)____
>
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3ctag%2Fdesign-reviews%2Fissues%2F375&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lcFcYkHGEBt%2B8C7Aby2zaqcBSEmLryk8zC8ZwcXWCN4%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3ctag%2Fdesign-reviews%2Fissues%2F375&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lcFcYkHGEBt%2B8C7Aby2zaqcBSEmLryk8zC8ZwcXWCN4%3D&reserved=0> (JSON

> modules)____
>
> __ __
>
> *TAG review status____*
>
> Issues addressed____
>
> __ __
>
> *Risks____*
>
> Interoperability and Compatibility____
>
> Given positive signals from other browser implementers we expect
> these features to have wide support across browser
> platforms.____
>
> __ __
>
> Gecko:____
>
> Import Assertions: Positive

> (https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmozilla%2Fstandards-positions%2Fissues%2F373&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=p89k8X6Db4zdj68tzfwuF9WoGH9hapRaxMJypdYS2tM%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmozilla%2Fstandards-positions%2Fissues%2F373&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=p89k8X6Db4zdj68tzfwuF9WoGH9hapRaxMJypdYS2tM%3D&reserved=0>)

> Worth prototyping____
>
> JSON Modules: Positive

> (https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwhatwg%2Fhtml%2Fissues%2F4315%23issuecomment-489537002&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=oWwA3ShEXMEPrL7IrOaVY9hfWQZpftydmsanQmZfbgA%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit
> hub.com%2Fwhatwg%2Fhtml%2Fissues%2F4315%23issuecomment-489537002&d
> ata=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c834
> 7%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUn
> known%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haW
> wiLCJXVCI6Mn0%3D%7C1000&sdata=oWwA3ShEXMEPrL7IrOaVY9hfWQZpftydmsan
> QmZfbgA%3D&reserved=0>)

>
>
> I agree that this is a positive comment! But, as

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbit.
> ly%2Fblink-signals&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57
> d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yzAS0uCz4JGkclxZEimZPSAszIP48PlnRX0FC%2BoWKd4%3D&reserved=0 <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbit.ly%2Fblink-signals&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yzAS0uCz4JGkclxZEimZPSAszIP48PlnRX0FC%2BoWKd4%3D&reserved=0> documents, the standards-positions repository is the right way to get Mozilla's "official standards position".

>
>
> ____
>
> WebKit:____
>
> Import Assertions: Positive____
>
> JSON Modules: No signal
>
>
> Can you link to the webkit-dev@ threads here?
>
>
> ____
>
> Web developers:____
>
> Import Assertions: Positive____
>
> JSON Modules: Strongly positive

> (https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwhatwg%2Fhtml%2Fissues%2F4315&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=jrHGLvCE4gBIUiEL0FivEP1LqInslJOLfrxcX12d7AA%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwhatwg%2Fhtml%2Fissues%2F4315&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078300873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=jrHGLvCE4gBIUiEL0FivEP1LqInslJOLfrxcX12d7AA%3D&reserved=0>) There were many

> expressions of support in #4315. There were some requests in
> that thread to expand the feature to support named exports, but
> the due to the complexity and ambiguity involved this was not
> included.____
>
> __ __
>
> *Ergonomics____*
>
> Import assertions will be used in tandem with new module types
> (JSON, CSS, HTML...), and may have additional future uses with
> module imports. Performance costs will be pay-for-play.____
>
> We expect JSON modules to be commonly used in tandem with
> JavaScript modules (and potentially other module types yet to
> come). The feature is built on Synthetic Modules as part of the
> existing module graph infrastructure so we don't expect any new
> performance issues.____
>
> __ __
>
> *Activation____*
>
> Build tools and polyfills may be useful for adoption as import
> assertions and JSON modules roll out across various browser
> platform implementations.____
>
> __ __
>
> *Security____*
>
> Import assertions are intended to address the security concern

> described in https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3c%2Fwebcomponents%2Fissues%2F839&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=7iwnufS2htDFUZBJogtFHZo%2BuixZhEbH9q7XUeq50cY%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit
> hub.com%2Fw3c%2Fwebcomponents%2Fissues%2F839&data=04%7C01%7Cdaniec
> %40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af
> 91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8
> eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1
> 000&sdata=7iwnufS2htDFUZBJogtFHZo%2BuixZhEbH9q7XUeq50cY%3D&res
> erved=0>.____

>
> Aside from that, these features do not have any particular
> security concerns. See the TAG security and privacy review

> (https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftc39%2Fproposal-import-assertions%2Fblob%2Fmaster%2Ftag-security-and-privacy.md&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=j6o2%2FwdCzTK6Lu2BgkQ1thiJH6J8vPGcxZW8sd%2FclbY%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit
> hub.com%2Ftc39%2Fproposal-import-assertions%2Fblob%2Fmaster%2Ftag-secu
> rity-and-privacy.md&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a5
> 7d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%
> 7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQI
> joiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=j6o2%2FwdCz
> TK6Lu2BgkQ1thiJH6J8vPGcxZW8sd%2FclbY%3D&reserved=0>)____

>
> __ __
>
> *Debuggability____*
>
> No special debuggability support needed.____
>
> __ __
>
> *Is this feature fully tested by web-platform-tests?____*
>
> Test suites here:____
>

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fweb-platform-tests%2Fwpt%2Ftree%2Fmaster%2Fhtml%2Fsemantics%2Fscripting-1%2Fthe-script-element%2Fimport-assertions&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=sPJ852%2FrhYvqXBQMQWffQy14Wdtgqo%2BCHEQDyB7z9pE%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit
> hub.com%2Fweb-platform-tests%2Fwpt%2Ftree%2Fmaster%2Fhtml%2Fsemantics%
> 2Fscripting-1%2Fthe-script-element%2Fimport-assertions&data=04%7C0
> 1%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988
> bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTW
> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6
> Mn0%3D%7C1000&sdata=sPJ852%2FrhYvqXBQMQWffQy14Wdtgqo%2BCHEQDyB7z9p
> E%3D&reserved=0>____
>
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fweb-platform-tests%2Fwpt%2Ftree%2Fmaster%2Fhtml%2Fsemantics%2Fscripting-1%2Fthe-script-element%2Fjson-module&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=5OA1%2BYWH3woGRYvv97bdQELb8RcUO3vTmCWMa%2FS8Otc%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit
> hub.com%2Fweb-platform-tests%2Fwpt%2Ftree%2Fmaster%2Fhtml%2Fsemantics%
> 2Fscripting-1%2Fthe-script-element%2Fjson-module&data=04%7C01%7Cda
> niec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f1
> 41af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZs
> b3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D
> %7C1000&sdata=5OA1%2BYWH3woGRYvv97bdQELb8RcUO3vTmCWMa%2FS8Otc%3D&a
> mp;reserved=0>____

>
> Note, I plan to add further coverage along the lines of these
> suggestions:
>

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs
> .chromium.org%2Fp%2Fchromium%2Fissues%2Fdetail%3Fid%3D1132413%23c15&am
> p;data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c
> 8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7
> CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1
> haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zugKNPiI%2BfERVm66z0xCYctc7i1Xy7R
> bI5Z9recXu9M%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbug
> s.chromium.org%2Fp%2Fchromium%2Fissues%2Fdetail%3Fid%3D1132413%23c15&a
> mp;data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40
> c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%
> 7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik
> 1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=zugKNPiI%2BfERVm66z0xCYctc7i1Xy7
> RbI5Z9recXu9M%3D&reserved=0>____
>
> __ __
>
> *Tracking bug____*
>
> crbug.com/1132413 <https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcrbug.com%2F1132413&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078310869%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Y8ISyqVspsUZw56DSm23MUoBQrqwljc8MY6b16gcesU%3D&reserved=0>, crbug.com/v8/10958
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.chromium.org%2Fp%2Fv8%2Fissues%2Fdetail%3Fid%3D10958&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Nraao6lPnx1lbaFybhnXhh8m1Upr5riWoImfAmPAgLE%3D&reserved=0> (import
> assertions) ____
>
> crbug.com/964248
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.chromium.org%2Fp%2Fchromium%2Fissues%2Fdetail%3Fid%3D964248&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=e%2F0kc2ZAwx9ym7dF786ktEv8ZIgQrkchZLWhuFTgPHQ%3D&reserved=0>

> (JSON modules)____
>
> __ __
>
> *Link to entry on the Chrome Platform Status____*
>

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchromestatus.com%2Ffeature%2F5765269513306112&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=xqLgLrF96qKdvI3cY0qh1K5569C2beLM47s8DFURdxs%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchromestatus.com%2Ffeature%2F5765269513306112&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=xqLgLrF96qKdvI3cY0qh1K5569C2beLM47s8DFURdxs%3D&reserved=0> (import
> assertions)____
>
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchromestatus.com%2Ffeature%2F5749863620804608&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Y0fZaDjCByGmbngqiGj9VFVKy0jTFYdWHv6DW297LqA%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchromestatus.com%2Ffeature%2F5749863620804608&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Y0fZaDjCByGmbngqiGj9VFVKy0jTFYdWHv6DW297LqA%3D&reserved=0> (JSON

> modules)____
>
> __ __
>
> *Links to previous Intent discussions____*
>
> Intent to prototype for import assertions (and ship, but that
> part of the request was rescinded at the time):

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fu%2F1%2Fa%2Fchromium.org%2Fg%2Fblink-dev%2Fc%2FXft04J07Oh0%2Fm%2FRLPMXVEiAAAJ&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=d%2F8SCdaoL4JP3epSXNWdM8NnKMD4P33HJ05YwyWJCCs%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgro
> ups.google.com%2Fu%2F1%2Fa%2Fchromium.org%2Fg%2Fblink-dev%2Fc%2FXft04J
> 07Oh0%2Fm%2FRLPMXVEiAAAJ&data=04%7C01%7Cdaniec%40microsoft.com%7C2
> e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1
> %7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAi
> LCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=d%2F8S
> CdaoL4JP3epSXNWdM8NnKMD4P33HJ05YwyWJCCs%3D&reserved=0>____

>
> Intent to implement for JSON modules:

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fu%2F1%2Fa%2Fchromium.org%2Fg%2Fblink-dev%2Fc%2FojwkySW-bpQ%2Fm%2FMo7POGPXAQAJ&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=aQQgxvu%2FcLsPQKRpqwjShx%2FcGyYMmZIZzNYVYQbieeU%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgro
> ups.google.com%2Fu%2F1%2Fa%2Fchromium.org%2Fg%2Fblink-dev%2Fc%2FojwkyS
> W-bpQ%2Fm%2FMo7POGPXAQAJ&data=04%7C01%7Cdaniec%40microsoft.com%7C2
> e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1
> %7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAi
> LCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=aQQgxv
> u%2FcLsPQKRpqwjShx%2FcGyYMmZIZzNYVYQbieeU%3D&reserved=0>____

>
> *__ __*
>
> *Known issues____*
>
> JSON modules are not yet implemented for ServiceWorkers. I plan
> to add ServiceWorker support in the coming weeks.____
>
> There is a known issue where parse errors are reported
> incorrectly for JSON modules: crbug.com/994315

> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.chromium.org%2Fp%2Fchromium%2Fissues%2Fdetail%3Fid%3D994315&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078320868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=39ArmrxHYZ4K1s1%2Bx7kjRNsCzuqSms7i4b4LkEr5yJA%3D&reserved=0>.

> However that there are similar issues for JS modules and other
> types of JSON parsing, so I'd prefer not to block on this. See
> notes in the bug.____
>
> __ __
>
> *Note on shipping jointly____*
>
> In some sense these are two separate features, with separate
> feature flags, but I think it makes sense to ship them jointly
> because:____
>
> 1. Import assertions don't yet do anything useful without JSON
> modules.____
> 2. JSON modules aren't usable without JSON modules without
> opening them up to the security issue described at

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3c%2Fwebcomponents%2Fissues%2F839&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078330855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=EcbtY38nq6uAZVKHHEbdNDM3OVBvJ8LACs3kEl%2BLS74%3D&reserved=0
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgit
> hub.com%2Fw3c%2Fwebcomponents%2Fissues%2F839&data=04%7C01%7Cdaniec
> %40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af
> 91ab2d7cd011db47%7C1%7C0%7C637510091078330855%7CUnknown%7CTWFpbGZsb3d8
> eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1
> 000&sdata=EcbtY38nq6uAZVKHHEbdNDM3OVBvJ8LACs3kEl%2BLS74%3D&res
> erved=0>.____

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fa%2Fchromium.org%2Fd%2Fmsgid%2Fblink-dev%2Ff014310e-a3e3-4061-89bf-2c64e1d5f48en%2540chromium.org&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078330855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=xRtf1Xme2%2FCcp%2B5TrpTvKhIx2RXJvnyxEU62hD5LEsY%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fa%2Fchromium.org%2Fd%2Fmsgid%2Fblink-dev%2Ff014310e-a3e3-4061-89bf-2c64e1d5f48en%2540chromium.org%3Futm_medium%3Demail%26utm_source%3Dfooter&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078330855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=5E6WF8NTEv0pW5naalw88Mey5DzYvx6nuM3TxiXcqHI%3D&reserved=0>.

> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgrou
> ps.google.com%2Fa%2Fchromium.org%2Fd%2Fmsgid%2Fblink-dev%2FCAKXHy%253D
> dLGxyrOJ%253D8TKC1ieAhs5vxS3jD_fDWSE9H%253DhwNMs2%253D7Q%2540mail.gmai
> l.com&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f
> 08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078
> 330855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJ
> BTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S4l8mRcu%2F40V98p68REvjJc
> Ms7kRnsv%2BspFYMaNBzEU%3D&reserved=0
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fa%2Fchromium.org%2Fd%2Fmsgid%2Fblink-dev%2FCAKXHy%253DdLGxyrOJ%253D8TKC1ieAhs5vxS3jD_fDWSE9H%253DhwNMs2%253D7Q%2540mail.gmail.com%3Futm_medium%3Demail%26utm_source%3Dfooter&data=04%7C01%7Cdaniec%40microsoft.com%7C2e41a57d187c4948341f08d8e40c8347%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637510091078330855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hxacyn%2B%2B09bTQt2Xkhl4MnkIDxWnRP4j%2FdtvAeDrGA0%3D&reserved=0>.

Artur Janc

unread,

Mar 18, 2021, 3:03:42 PM3/18/21

to blink-dev, Daniel Clark, blin...@chromium.org, litt...@igalia.com, Shu-yu Guo, ma...@google.com, cbr...@google.com, Kouhei Ueno, hiro...@google.com, Domenic Denicola, Manuel Rego, mk...@chromium.org, Alex Russell

It would be great for the proposal to devote a little more attention to how it addresses the risk of leaking cross-origin JSON resources by loading them as a JSON module. Currently, JSON resources are protected from XSSI (https://www.scip.ch/en/?labs.20160414) because they don't parse as script; but enabling APIs that load JSON-formatted data has the potential to change this.

I'm fairly sure the currently proposed behavior is safe because the module is loaded via CORS (so it requires the resource to opt into being loaded). I just haven't seen this aspect called out in the security notes mentioned by this intent and wanted to call it out.

Daniel Clark

unread,

Mar 26, 2021, 6:58:43 PM3/26/21

to a...@google.com, blin...@chromium.org, blin...@chromium.org, litt...@igalia.com, s...@google.com, ma...@google.com, cbr...@google.com, kou...@google.com, hiro...@google.com, dom...@google.com, re...@igalia.com, mk...@chromium.org, sligh...@google.com

Thanks Artur for raising this point. Your second paragraph is correct -- JSON modules do not introduce a new vector for leaking JSON cross-origin, because EcmaScript module imports (including those of JSON content) use CORS. A JSON resource must be sent with an Access-Control-Allow-Origin header in order to be imported cross-origin as a JSON module.

I’ve updated the ChromeStatus entry https://chromestatus.com/feature/5749863620804608#details to mention this. I’m thinking about adding something about this to the TC39 explainer as well, but this is a web-specific concern that might be out of scope for that venue.

Mathias Bynens

unread,

Jun 14, 2021, 7:08:04 AM6/14/21

to Daniel Clark, blin...@chromium.org, litt...@igalia.com, s...@google.com, ma...@google.com, cbr...@google.com, kou...@google.com, hiro...@google.com, dom...@google.com, Yang Guo

Debuggability […] No special debuggability support needed.

I agree we probably don't need any special support through new DevTools features, but IMHO we should make sure the basics work for import assertions. Currently, the “jump-to-source” links don't work for any import assertion errors. I’ve filed https://bugs.chromium.org/p/chromium/issues/detail?id=1219447 for this — Daniel, could you please take a look?

--

You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/BL0PR00MB030820DE53789C6DCE72B0E8C5969%40BL0PR00MB0308.namprd00.prod.outlook.com.

Daniel Clark

unread,

Jun 14, 2021, 7:41:28 PM6/14/21

to mt...@google.com, blin...@chromium.org, litt...@igalia.com, s...@google.com, ma...@google.com, cbr...@google.com, kou...@google.com, hiro...@google.com, dom...@google.com, yan...@google.com