Actually I think the CSP repo ( https://github.com/WebAssembly/content-security-policy) has more up-to-date discussion (including, of course, Charles's own issue; thanks for filing that :)
On Tue, Feb 13, 2018 at 5:19 PM Alon Zakai <alonza...@gmail.com> wrote: > Talking to some people about this, it seems like there isn't a clear > cross-browser policy on wasm and CSP. So it's not necessarily a bug if > browsers disagree on this. Which is worrying... > > More discussion and details here: > https://github.com/WebAssembly/design/issues/1092 > > On Thu, Feb 8, 2018 at 10:59 AM, Charles Vaughn <cvau...@gmail.com> wrote: > >> I've put together a simple test here: >> https://s3.amazonaws.com/webassembly-chrome-csp/csp_test.html >> >> It uses the simple.wasm from MDN. >> >> On Wednesday, February 7, 2018 at 9:46:50 AM UTC-8, Alon Zakai wrote: >>> >>> Does that happen even on a simple hello world program using wasm? Or is >>> this a special case somehow? >>> >>> On Mon, Feb 5, 2018 at 1:07 PM, Charles Vaughn <cva...@gmail.com> wrote: >>> >>>> Getting this error in Chrome 64 and Chrome Canary: >>>> >>>> The source list for Content Security Policy directive 'default-src' >>>> contains an invalid source: ''wasm-eval''. It will be ignored. >>>> runtimeweb.pretty.js:1063 [Report Only] Refused to compile or >>>> instantiate WebAssembly module because 'wasm-eval' is not an allowed source >>>> of script in the following Content Security Policy directive: "script-src >>>> *". >>>> >>>> doNativeWasm @ runtimeweb.pretty.js:1063 >>>> Module.asm @ runtimeweb.pretty.js:1134 >>>> (anonymous) @ runtimeweb.pretty.js:6121 >>>> >>>> I've tried enabling the 'wasm-eval' source option, but it seems Chrome >>>> only supports that for extensions. I do not get CSP errors in Firefox or >>>> Edge. >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "emscripten-discuss" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to emscripten-discuss+unsubscr...@googlegroups.com. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> >>> -- >> You received this message because you are subscribed to the Google Groups >> "emscripten-discuss" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to emscripten-discuss+unsubscr...@googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. >> > > -- > You received this message because you are subscribed to the Google Groups > "emscripten-discuss" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to emscripten-discuss+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "emscripten-discuss" group. To unsubscribe from this group and stop receiving emails from it, send an email to emscripten-discuss+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
