According to https://github.com/w3c/ServiceWorker/issues/1032#issuecomment-267683646, `importScripts()` imports a script served with `Content-Type:"text/html"` and `X-Content-Type-Options:"nosniff"`. We should be applying `nosniff` to that script load. I thought `importScripts()` eventually ran through https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/ScriptLoader.cpp?rcl=92c26eed9fd8834e1da3283e8bd45952aa4f0d6b&l=483, but it apparently doesn't? Or we're not catching the headers correctly? Either way, seems like we should fix it.
I'll take this issue.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/483690f08302c4e870ca10e7685cc9b551bd43c7 commit 483690f08302c4e870ca10e7685cc9b551bd43c7 Author: horo <horo@chromium.org> Date: Mon Feb 13 13:09:14 2017 Implement script MIME restrictions for X-Content-Type-Options: nosniff for Workers The restrictions for ScriptResources were introduced 4 years ago. https://chromium.googlesource.com/chromium/src/+/54acddd3e95047b46c0afd4482313a078378680f But the restrictions for worker scripts were not introduced. BUG= 689003 Review-Url: https://codereview.chromium.org/2689173002 Cr-Commit-Position: refs/heads/master@{#449937} [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/MANIFEST.json [add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/WorkerGlobalScope_importScripts_NosniffErr.htm [add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/Worker_NosniffErr.htm [add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/support/ImportScriptsNosniffErr.js [add] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/LayoutTests/external/wpt/workers/support/nosiniff-error-worker.py [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/dom/ScriptLoader.cpp [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/loader/resource/ScriptResource.cpp [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/loader/resource/ScriptResource.h [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/workers/WorkerScriptLoader.cpp [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/core/workers/WorkerScriptLoader.h [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/platform/network/ResourceResponse.cpp [modify] https://crrev.com/483690f08302c4e870ca10e7685cc9b551bd43c7/third_party/WebKit/Source/platform/network/ResourceResponse.h
Comment 1 by horo@chromium.org
, Feb 10 2017Owner: horo@chromium.org
Status: Assigned (was: Available)