Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Data URL dedicated worker needs its own agent cluster #5254

Open
annevk opened this issue Feb 5, 2020 · 1 comment · May be fixed by #5476
Open

Data URL dedicated worker needs its own agent cluster #5254

annevk opened this issue Feb 5, 2020 · 1 comment · May be fixed by #5476
Labels
topic: agent The interaction with JavaScript's agent and agent cluster concepts topic: workers

Comments

@annevk
Copy link
Member

annevk commented Feb 5, 2020

A data URL dedicated worker has an opaque origin. It therefore should not be in the agent cluster of its creator, as that would create a limited information leak.

However, this would mean that a browsing context group can hold agent clusters that do not contain a "window agent". This would require adjusting that a bit. Can it later start to hold a "window agent" through clever usage of blob URLs? Blob URLs have some same-origin navigation limitations, but do those also apply in noopener type situations? (See also w3c/FileAPI#135.)

While data URLs are not the best use case, eventually we want sandboxing to apply to workers as well, and then this would apply to more URL schemes.

Relevant for #5210.

(Realized this while working on web-platform-tests/wpt#21146.)
@annevk annevk added topic: workers topic: agent The interaction with JavaScript's agent and agent cluster concepts labels Feb 5, 2020
@annevk annevk mentioned this issue Feb 5, 2020
Merged
@annevk
Copy link
Member Author

annevk commented Apr 14, 2020

@domenic we forgot about this case unfortunately, but it should be easier to fix now. I'll have another look at the tests first as they are not working at all...

@annevk annevk mentioned this issue Apr 15, 2020
Closed
annevk added a commit that referenced this issue Apr 21, 2020
@annevk
Put data URL dedicated workers in their own agent cluster
259a76a 
Tests:

* There should be a test for this where you create a data URL worker and try to message it SAB and WebAssembly.Module and check that it results in messageerror events.
* web-platform-tests/wpt#21146 and web-platform-tests/wpt#22928 test that inside a data URL worker you can share memory with a further nested data URL worker that is same-origin with the opaque origin of the data URL worker.

Fixes #5254.
@annevk annevk linked a pull request Apr 21, 2020 that will close this issue
Open
3 tasks
@annevk annevk mentioned this issue Nov 6, 2020
Open
@annevk annevk mentioned this issue Oct 15, 2021
Closed
@annevk annevk mentioned this issue Mar 11, 2023
Open
annevk added a commit that referenced this issue Mar 11, 2023
@annevk
Put data URL dedicated workers in their own agent cluster
70a35c4 
Tests:

* There should be a test for this where you create a data URL worker and try to message it SAB and WebAssembly.Module and check that it results in messageerror events.
* web-platform-tests/wpt#21146 and web-platform-tests/wpt#22928 test that inside a data URL worker you can share memory with a further nested data URL worker that is same-origin with the opaque origin of the data URL worker.

Fixes #5254.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
topic: agent The interaction with JavaScript's agent and agent cluster concepts topic: workers
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Put data URL dedicated workers in their own agent cluster whatwg/html
1 participant
@annevk