| 14:10 | <bakkot> | guybedford: if I have a CSP of script-src 'self', and then import source foo from './foo.wasm'; WebAssembly.instantiate(foo), does that work or does the CSP also need to include unsafe-wasm-eval? |
| 14:12 | <bakkot> | I know the import source part should work; I'm asking if the WebAssembly.instantiate has a separate gate. I think the idea is that it does not have a separate gate and so the snippet above works? the wasm csp proposal has HostEnsureCanCompileWasmBytes which claims to only guard WebAssembly.compile and compileStreaming |
| 14:13 | <nicolo-ribaudo> | I unfortunately cannot join today. I still plan to review Guy's PRs. |
| 15:04 | <guybedford> | Thanks nicolo-ribaudo I will wait for your review on https://github.com/WebAssembly/esm-integration/pull/104 before landing it. It would be nice to be able to land the corresponding Node.js PR before the 24 release cutoff with this if possible as well. |
| 15:05 | <Chengzhong Wu> | v24 was cut off already |
| 15:06 | <Chengzhong Wu> | https://github.com/nodejs/node/pull/57609 |
| 15:55 | <guybedford> | ahh right, thanks, landing as soon as possible then at least |