3 ms·
Both FireFox and Safari support same origin CSP on instantiateStreaming sources though, which doesn't work on Chrome.
by hackcasual 7y ago
Both FireFox and Safari support same origin CSP on instantiateStreaming sources though, which doesn't work on Chrome.
- namibj 7y agoI actually mean even harsher restrictions than just some same-origin. Specifically, I mean using already-existing mechanics to figure out whether the global object is reachable by the WASM code. If so, treat as unsafe-eval for all I care. If not, treat as risky as the functionality exposed to the WASM code (testing reachability for other objects/functions that are not the global object itself).