New issue
Advanced search Search tips

Issue 875114 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 3
Type: Feature



Sign in to add a comment

sync-script is too restrictive

Project Member Reported by ericbidelman@chromium.org, Aug 17

Issue description

Chrome Version: 70.0.3524.0 (Official Build) canary (64-bit)
OS: MacOS X

Consider the following page:

<html>
<body>
...
<script>
  console.log('did I run?');
</script>
</body>
</html>

It's widely considered a best practice to move scripts to the bottom of the page. A really common example is loading Google analytics (ran into this myself on a demo page testing feature policy!):

...
<script async src="https://www.googletagmanager.com/..."></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'UA-120357238-1');
</script>
</body>
</html>

However, this code is blocked under `Feature-Policy: sync-script 'none'`.

This is tricky, because technically the policy is doing what it's supposed to...but
I'd hate to penalize developers for doing the right thing.

Can/should we ignore inline scripts? Or should we ignore final scripts like this?

==

Steps to repro:
1. Visit https://chain-dragon.glitch.me/

What is the expected result?

This inline script at the bottom of the page is not blocked by feature policy.

What is happens instead?

Sending `Feature-Policy: sync-script 'none'` blocks the script.

 
Cc: -japhet@chromium.org
Labels: -Type-Bug OS-Android OS-Chrome OS-Linux OS-Mac OS-Windows Type-Feature
Owner: japhet@chromium.org
Status: Assigned (was: Untriaged)
I am assigning this to japhet@ who implemented the feature.

I wonder if the last <script> *can* be determined during parsing. Woudn't the very next <script> be the tentative "last"? (I am not quite familiar with parser code though). 

Also I am wondering if it makes sense to move such important scripts to a separate file and provide permission for 'self'. This still does not work when we absolutely want sync-script 'none' on the page.

Comment 2 Deleted

Sign in to add a comment