Repository navigation
Should strict MIME type for importScripts() also be enforced on local URLs? #8869
Description
#4001 set up a strict MIME type enforcement for importScripts(). However while all UAs seem to have agreed about external URLs, and tests are written for these, there is a compat issue regarding local URLs (data: and blob:).
Both Chrome and Firefox seem to not look at the MIME type of such URLs, while Safari and if I read correctly, the specs, do throw on these too. Quick test cases: data: URL, and blob: URL.
I'm not sure what would be the best here. These being local might warrant a special case (e.g I wouldn't be surprised to see a blob: URL pointing to a dynamically created script on which the type wasn't set).
Originally posted in #4001 (comment)
Activity
annevk commentedon Feb 9, 2023
cc @evilpie @mikewest @youennf
Ensure scripty type for local URLs
evilpie commentedon Feb 10, 2023
We don't have any telemetry in Firefox for
importScriptsornew Workerwithdata:,blob:etc. with non JS MIME types, so that would be best to add first.Workers: ensure scripty type for local URLs in importScripts
Bug 1815847 [wpt PR 38430] - Ensure scripty type for local URLs in im…
Bug 1815847 [wpt PR 38430] - Ensure scripty type for local URLs in im…
Workers: ensure scripty type for local URLs in importScripts
Bug 1819626: Enforce strict MIME type checks for worker-imported scri…
evilpie commentedon Mar 29, 2023
Probably not a deal breaker, but this caused a regression in emscripten: emscripten-core/emscripten#19080 (https://bugzilla.mozilla.org/show_bug.cgi?id=1824839)
annevk commentedon Mar 26, 2025
Since we have test coverage through web-platform-tests/wpt#38430 at this point this is just a bug in Chromium.
Bug 1819626: Enforce strict MIME type checks for worker-imported scri…