Merge CSP into main by fgmccabe · Pull Request #2198 · WebAssembly/spec

fgmccabe · 2026-06-23T18:52:26Z

This (should) reflect changes needed to incorporate phase 4 csp.

This should probably NOT just be merged, as the change seems to include notes that might not normally be part of the spec.

Issue #1

Provide background on CSP threat model and use cases

Pull in latest changes from WebAssembly/spec repo

Rename 'wasm-eval' to 'wasm-unsafe-eval' Fixes #15.

Remove reference to mimetype hardening

Always allow WebAssembly.validate()

Rework final table for clarity

Summarize API behavior and threats relative to CSP

Fixed #1435.

@ericprud

At yesterday's WG meeting, we decided to make a new release, now switching to the Evergreen model. For administrative and technical reasons having to do with W3C procedure, we decided to bump the release number to 2. From now on, the standard will iterate at version 2 from the W3C's official perspective. We use minor release numbers internally to distinguish different iterations. (@ericprud, I hope I understood correctly that the Bikeshed "level" also needed to be bumped to 2.)

Curfuffle

Redundant: already covered in js-api

Merge from upstream wasm 3.0

Not needed in web-api spec.

tlively

Are there expected to be any tests here?

tlively · 2026-06-23T22:49:26Z

Are the deletions here expected? It seems it would be better to edit the "Security and Privacy Considerations" section rather than remove it.

Yes we should keep this.

rossberg · 2026-06-23T23:39:26Z

 [![CI for specs](https://github.com/WebAssembly/spec/actions/workflows/ci-spec.yml/badge.svg)](https://github.com/WebAssembly/spec/actions/workflows/ci-spec.yml)
 [![CI for interpreter & tests](https://github.com/WebAssembly/spec/actions/workflows/ci-interpreter.yml/badge.svg)](https://github.com/WebAssembly/spec/actions/workflows/ci-interpreter.yml)

+# Content Security Policy Proposal for WebAssembly


You'll want to undo the changes to the README.

Removed the Content Security Policy proposal section from the README.

eqrion

I'd also be interested to know if there are tests for this already in WPT.

eqrion · 2026-07-14T19:05:01Z

Yes we should keep this.

eqrion · 2026-07-14T19:23:26Z

+<h3 id="host-ensure-can-compile-wasm-bytes">HostEnsureCanCompileWasmBytes()</h3>
+
+<dfn abstract-op>HostEnsureCanCompileWasmBytes()</dfn> is an implementation-defined abstract operation
+that allows host environments to block certain WebAssembly functions which
+compile bytes into WebAssembly code.
+
+An implementation of HostEnsureCanCompileWasmBytes may complete normally or
+abruptly. Any abrupt completions will be propagated to its callers. The default
+implementation of HostEnsureCanCompileWasmBytes is to unconditionally return an
+empty normal completion.


The concrete instantiation of this abstract operation requires a realm to be passed in [1]. I think we need to have that be an operand and explicitly provide it. We can probably just do Let |realm| be the [=current Realm=] in the right places.

Also CSP calls it "EnsureCSPDoesNotBlockWasmByteCompilation" not HostEnsureCanCompileWasmBytes. Not sure if that's an issue.

[1] https://w3c.github.io/webappsec-csp/#can-compile-wasm-bytes

eqrion · 2026-07-14T19:26:58Z


 <div algorithm>
  To <dfn>compile a WebAssembly module</dfn> from source bytes |bytes|, perform the following steps:
+    1. Perform [$HostEnsureCanCompileWasmBytes()$].


This will happen when you call WebAssembly.validate. Is that intentional? It's also called by "asynchronously compile a WebAssembly module" in the "in parallel" section. My understanding is that's not allowed because it implies there could be racy accesses to the realm to perform the CSP check.

I think we should remove this check here and move it to the JS-API entry points that need it. So the WebAssembly.Module constructor, WebAssembly.compile, WebAssembly.instantiate, and WebAssembly.instantiateStreaming.

eqrion · 2026-07-14T19:32:40Z


 <div algorithm>
  To <dfn>compile a WebAssembly module</dfn> from source bytes |bytes|, perform the following steps:
+    1. Perform [$HostEnsureCanCompileWasmBytes()$].


Suggested change

1. Perform [$HostEnsureCanCompileWasmBytes()$].

1. Perform [=?=] [$HostEnsureCanCompileWasmBytes()$].

I believe we can use the ReturnIfAbrupt macro here. We use it elsewhere in the spec.

flagxor and others added 30 commits November 1, 2017 10:12

Adding CSP proposal.

eee3f9b

Update README.

d69bc5d

Provide background on CSP threat model and use cases

7aa2d37

Issue #1

Add table detailing combinations.

14755e6

Merge pull request #6 from eholk/threat-model

0487ca8

Provide background on CSP threat model and use cases

Summarize API behavior and threats relative to CSP

ed2c962

Fix typos

21342e3

Reaffirm out of scope risks

0659dc5

Merge branch 'master' of github.com:WebAssembly/spec into merge-master

60c71ca

Pull in latest changes from WebAssembly/spec repo

05341cd

Pull in latest changes from WebAssembly/spec repo

Starting to define abstract operation hooks

7d3b908

Add HostEnsureCanCompileWasmBytes hook for CSP

d2caac3

Add HostEnsureCanCompileWasmResponse for interacting with CSP

e22a366

Delete spurious newline

87945e9

Add table entries for instantiation

3eef43b

Reword paragraph about CSP threat model

529968a

Merge branch 'master' into threat-summary

0acfec0

Rename \'wasm-eval\' to \'wasm-unsafe-eval\'

60bbf51

Remove reference to mimetype hardening

fca6045

Always allow WebAssembly.validate()

55eae1b

Merge pull request #17 from WebAssembly/rename_wasm_eval

fe0e372

Rename 'wasm-eval' to 'wasm-unsafe-eval' Fixes #15.

Merge pull request #18 from WebAssembly/remove_mime_type

53f60d4

Remove reference to mimetype hardening

Rework final table for clarity

86a899f

Merge pull request #20 from WebAssembly/allow_validate

f1cb729

Always allow WebAssembly.validate()

Fix table

8fd4402

Add note about unsafe-eval implying wasm-unsafe-eval

e822b29

Merge branch 'master' into rework_final_table

edb4502

Merge pull request #21 from WebAssembly/rework_final_table

0c9bce3

Rework final table for clarity

Merge pull request #16 from WebAssembly/threat-summary

57b7b52

Summarize API behavior and threats relative to CSP

fix typo

ca8a1b3

ngzhian and others added 26 commits April 18, 2022 11:38

[spec] Fix missing mention of vectype (#1436)

e15864d

Fixed #1435.

[spec] Fix single-table limitation in module instantiation (#1434)

74381a7

[spec] Fix missing immediate on table.set (#1441)

a5bd4b9

[docs] Update syntax in examples (#1442)

0121c84

Clarification in proposals README

be2489e

[interpreter] Tweak start section AST to match spec

e190ac3

Starting to define abstract operation hooks

7bcf319

Add HostEnsureCanCompileWasmBytes hook for CSP

13fcaec

Revised and simplified note

c3996e8

Changed wasm-eval to wasm-unsafe-eval

9247d8d

Removed funny dangling entry

31ede6b

Ensure compile as well as compile streaming guarded

c274959

Remove duplicate text

2746eae

Merge pull request #41 from WebAssembly/curfuffle

dd75e5b

Curfuffle

Merge remote-tracking branch 'upstream/main' into curfuffle

ed5df37

Take out use of HostEnsureCanCompileWasmBytes from web-api

011ae57

Redundant: already covered in js-api

Merge remote-tracking branch 'upstream/wasm-3.0' into curfuffle

63f01a2

Merge pull request #45 from WebAssembly/curfuffle

cfa8673

Merge from upstream wasm 3.0

Drop some spaces

04b0388

Drop more spaces

9f09100

Add back section on implementation defined operations

7c1478f

Remove bytes argument from HostEnsureCanCompileWasmBytes

2b81a76

Fixed markdown indentation error

48feb4b

Remove reference to HostEnsureWasmCanCompile

893da3b

Not needed in web-api spec.

Merge remote-tracking branch 'upstream/main'

284adaf

tlively reviewed Jun 23, 2026

View reviewed changes

rossberg reviewed Jun 23, 2026

View reviewed changes

Update README to remove CSP proposal details

8227401

Removed the Content Security Policy proposal section from the README.

eqrion requested changes Jul 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Merge CSP into main#2198

Merge CSP into main#2198
fgmccabe wants to merge 83 commits into
mainfrom
csp

fgmccabe commented Jun 23, 2026

Uh oh!

tlively left a comment

Uh oh!

tlively Jun 23, 2026

Uh oh!

eqrion Jul 14, 2026

Uh oh!

rossberg Jun 23, 2026

Uh oh!

eqrion left a comment

Uh oh!

eqrion Jul 14, 2026

Uh oh!

eqrion Jul 14, 2026

Uh oh!

eqrion Jul 14, 2026

Uh oh!

eqrion Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

	1. Perform [$HostEnsureCanCompileWasmBytes()$].
	1. Perform [=?=] [$HostEnsureCanCompileWasmBytes()$].

Uh oh!

Conversation

fgmccabe commented Jun 23, 2026

Uh oh!

tlively left a comment

Choose a reason for hiding this comment

Uh oh!

tlively Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

eqrion Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

rossberg Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

eqrion left a comment

Choose a reason for hiding this comment

Uh oh!

eqrion Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

eqrion Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

eqrion Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

eqrion Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants