Skip to content

add CSP policy note #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guybedford merged 4 commits into from
Mar 21, 2025
Merged

add CSP policy note #78

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2d4cd46
add CSP policy note
Mar 28, 2024
05ace87
rewording
Mar 28, 2024
5156f41
update note that Wasm is likely not a stricter policy
Apr 2, 2024
5a487eb
Merge branch 'main' into csp-note
Apr 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion proposals/esm-integration/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,13 @@ If initially implementing just source phase imports, the `GetExportedNames`, `Re

Implementers are encouraged to ship both stages at once, but it is deemed OK for implementers to initially ship the first stage and then quickly follow up with the second stage, if this aids "time to ship" in implementations.

### Content Security Policy

Wasm modules imported through the ES Module system should be verified for compilation by CSP against the `script-src` directive, both for static and dynamic imports. This allows Wasm and JS to be equally supported in the ESM
integration under CSP policies.

While Wasm is currently fully sandboxed, having equal access to imports to JS provides it equal capabilities to execution primitives, so that it should not be considered a weaker capability from an ESM integration perspective.

## FAQ

### Does the source phase replace the instance linking?
Expand All @@ -128,7 +135,7 @@ The [Component Model](https://github.com/WebAssembly/component-model) has its ow

In components it is possible to import both other components and core modules through the host linker, and it is possible to obtain them either as instances or uninstantiated modules. This linking model of the component model is therefore fully compatible with the linking model of the ESM integration, where these represent the host instance linking and source phases respectively and components effectively as a third module type. Components are distinguished from core Wasm in their leading bytes. Components may be more likely to support a highly usable host instance linking model ESM integration than core Wasm, while their source phase imports in turn would also be useful in virtualization workflows in JS embeddings.

### Why does this proposal not use import attribtues?
### Why does this proposal not use import attributes?

[Import attributes](https://github.com/tc39/proposal-import-attributes) parameterize module imports in the module system. Currently HTML specifies a `"type"` attribute which is a requirement for CSS or JSON module imports due to their having different security privileges over full execution.

Expand Down