Put policies in the blob URL store
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- html
- Domain
- security
Research direction
Start at the URL.createObjectURL() entry point and trace how entries are stored in the blob URL store and later used to create documents. Determine how policies should be cloned and made available through that flow; done means the relevant policies are retained without allowing a blob URL to gain privileges over its creating document.
Written by the indexing model from the issue text.
Description
It would be ideal that when URL.createObjectURL() is invoked all policies (CSP, referrer policy, etc.) are cloned and stored in the blob URL store so that they can be used when the blob URL is used to create a document.
This might have to be somewhat hand-wavy initially, but can hopefully be formalized over time as we document how to create, store, and inherit policies.
(In particular this approach helps ensure that however the user decides to open the blob URL, relevant policies will be there and there's not some escalation of privilege possible relative to the document that minted the URL.)
cc @mikewest @hiroshige-g
- Dominant language
- HTML
- Stars
- 118
- Forks
- 52
- Avg merge
- 9d 16h
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from w3c/FileAPI
-
TPAC2026
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 62/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
Similar issues
-
Product: Azure Policy :shield: Topic: Diagnostic Settings :test_tube: Topic: Policy :pencil:
Difficulty 1/5 1-3 hours Newbie friendliness 92/100
Azure/Azure-Landing-Zones#4283 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
MystenLabs/MemWal#979 · 1 comment ·
-
namespace operations
Difficulty 1/5 Under an hour Newbie friendliness 82/100
EclipseFdn/open-vsx.org#13384 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
documentation
Difficulty 2/5 Half a day Newbie friendliness 62/100
inmanta/inmanta-core#10835 ·