consult document CSP in Register algorithm
Open
Nobody has claimed this yet.
TPAC2025
- Dominant language
- Bikeshed
- Stars
- 3.6k
- Forks
- 324
- Avg merge
- 14d 22h
- Merged PRs (30d)
- 1
Description
It seems during .register() we should be consulting the CSP of the document to see if the script is allowed. Or is this handled in Run Service Worker in some way? It was not obvious to me.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the Register algorithm and the Run Service Worker section in the Service Worker specification, focusing on whether the document's CSP is consulted for the script. Determine which algorithm should define this behavior and what normative change would make the CSP handling explicit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100