Support for WebAssembly in Chrome Apps (via CSP) |
||||
Issue descriptionChrome Apps provide a fixed CSP policy. WebAssembly currently is only under the unsafe-eval directive (or the absence of a policy). tsepez and other have agreed to the notion that we can allow WebAssembly for all chrome apps. There are now Chrome Apps eager to migrate off Native Client (which is allowed) to Wasm (which is not), that are blocked on this. We should add a mechanism to whitelist Wasm for Chrome Apps. We have a early CG proposals around CSP that might end with a wasm-eval directive. We could implement this for chrome apps only and add to the canned chrome apps policy, or we might do something more direct.
,
Nov 15 2017
Do we mean extensions, or apps? (Aren't apps going away?) Could it be an extension permission instead of a whitelist?
,
Nov 15 2017
Apps are still used for ChromeOS, which is the main reason we need this. My understanding is that extensions are allowed to set their own CSP, so they can get Wasm via 'unsafe-eval'. Apps are restricted to a fixed CSP that does not include 'unsafe-eval'.
,
Nov 15 2017
I see, thanks!
,
Aug 14
Was this fixed by crrev.com/520311 ?
,
Aug 14
Yes.
,
Dec 6
|
||||
►
Sign in to add a comment |
||||
Comment 1 by bradnelson@chromium.org
, Nov 15 2017