{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/293","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/293/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/293/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/293/events","html_url":"https://github.com/w3c/webappsec-csp/pull/293","id":297950413,"number":293,"title":"Minimal specification of 'wasm-eval' source directive","user":{"login":"eholk","id":105766,"avatar_url":"https://avatars2.githubusercontent.com/u/105766?v=4","gravatar_id":"","url":"https://api.github.com/users/eholk","html_url":"https://github.com/eholk","followers_url":"https://api.github.com/users/eholk/followers","following_url":"https://api.github.com/users/eholk/following{/other_user}","gists_url":"https://api.github.com/users/eholk/gists{/gist_id}","starred_url":"https://api.github.com/users/eholk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eholk/subscriptions","organizations_url":"https://api.github.com/users/eholk/orgs","repos_url":"https://api.github.com/users/eholk/repos","events_url":"https://api.github.com/users/eholk/events{/privacy}","received_events_url":"https://api.github.com/users/eholk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-16T23:23:56Z","updated_at":"2018-02-17T08:12:55Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/w3c/webappsec-csp/pulls/293","html_url":"https://github.com/w3c/webappsec-csp/pull/293","diff_url":"https://github.com/w3c/webappsec-csp/pull/293.diff","patch_url":"https://github.com/w3c/webappsec-csp/pull/293.patch"},"body":"This adds the `'wasm-eval'` source as an allowed option for the `script-source` directive.\n\nThis is a minimal specification that allows WebAssembly with CSP without requiring `'unsafe-eval'` (although `'unsafe-eval'` effectively impllies `'wasm-eval'` to maintain current behavior).\n\nImplementations are required to gate `WebAssembly.instantiate`, and may choose to gate `new WebAssembly.Module` and `WebAssembly.compile`. This is done to support the [existing behavior](https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md#behavior-of-current-implementations) among browsers.\n\nNote that this does not address `WebAssembly.compileStreaming` and `WebAssembly.instantiateStreaming`. The plan is to spec the behavior around these APIs at a later time.\n\n\n<!--\n    This comment and the below content is programatically generated.\n    You may add a comma-separated list of anchors you'd like a\n    direct link to below (e.g. #idl-serializers, #idl-sequence):\n\n    Don't remove this comment or modify anything below this line.\n    If you don't want a preview generated for this pull request,\n    just replace the whole of this comment's content by \"no preview\"\n    and remove what's below.\n-->\n***\n<a href=\"https://pr-preview.s3.amazonaws.com/eholk/webappsec-csp/pull/293.html\" title=\"Last updated on Feb 16, 2018, 11:24 PM GMT (7363f1b)\">Preview</a> | <a href=\"https://pr-preview.s3.amazonaws.com/w3c/webappsec-csp/293/e333f87...eholk:7363f1b.html\" title=\"Last updated on Feb 16, 2018, 11:24 PM GMT (7363f1b)\">Diff</a>"},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/366425511","html_url":"https://github.com/w3c/webappsec-csp/pull/293#issuecomment-366425511","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/293","id":366425511,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars0.githubusercontent.com/u/1544111?v=4","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2018-02-17T08:12:55Z","updated_at":"2018-02-17T08:12:55Z","author_association":"MEMBER","body":"> may choose to gate\r\n\r\nWhy may?\r\n\r\n> The plan is to spec the behavior around these APIs at a later time.\r\n\r\nWhat's the migration story for sites already using wasm-eval?"}}
{"actor":{"display_login":"annevk"}}