CSS and JSON module scripts and CSP

[annevk]

WebAssembly/esm-integration#56 made me wonder what happens for CSS and JSON module scripts and it seems that since destination is "script", CSP will use script-src for them. Is that really what we want?

cc @lweichselbaum @antosart @mikewest @guybedford @dandclark @whatwg/modules

[guybedford]

This definitely seems strange to me and like something that should be fixed - that CSS imports should be style-src and JSON imports should be something else but not script-src since they don't represent any execution. There is also no escalation possibility here by design since the import './data.json' assert { type: 'json' } assertion syntax being mandated guarantees that we know the policy in play.

Given that import assertions are mandated perhaps that gives us the flexibility to use that to infer the CSP policy as well?

Alternatively I see the CSP spec does have a response phase, so the alternative could be do perform all module CSP checking in the response phase perhaps?

I hope we can solve this as it would be highly beneficial to lay the way for wasm-src as well and avoid the permanent need for a non-granular unsafe-inline-wasm in policies.

[bathos]

All of them end up "being" JS modules, right? What are the benefits of distinguishing them based on the source media type rather than the destination type?

[rniwa]

What are the benefits of distinguishing them based on the source media type rather than the destination type?

So that some file allowed to be imported as a CSS module can't be simultaneously imported as JS and start running arbitrary scripts. The same way we wanted to specify the type of module where it's used, it's important for CSP to be able to specify & restrict how a given content can be interpreted.

[ljharb]

If CSP can restrict it, then is there still a need for an import assertion?

[bathos]

@ljharb AFAIK a CSP can only express constraints which apply after the type/usage is known - e.g. style-src 'self' says that all self-origin URL resources can be interpreted as stylesheets, not that they will be / must be.

[guybedford]

Does anyone have any reasonable objections for treating the import assertion as a CSP policy type indicator?

[rniwa]

If CSP can restrict it, then is there still a need for an import assertion?

Yes. There are plenty of websites where CSP isn't deployed or can't be deployed for various reasons. We need a way to ensure CSS or JSON files wouldn't start parsing as JS specially on a server with content based MIME type detection.