Content Security Policy: fix unsafe-eval

[t3chguy]

Split off from #3632

At this time it is not possible to disable unsafe-eval as it will break WASM. In future this will be possible, this issue is to remind us to do such when all browsers support this.

[stoically]

as it will break WASM

Just to have it mentioned: this is a Chrome limitation - Firefox allows WASM without unsafe-eval.

[t3chguy]

I believe also Safari, which is a browser which riot-web claims to support.

[stoically]

Related: https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md#behavior-of-current-implementations

[DemiMarie]

Using WebAssembly.instantiateStreaming would avoid this problem.

[rugk]

Using WebAssembly.instantiateStreaming would avoid this problem.

As far as I know, no, it does not fix the problem, unfortunately. Chromium 90.0.4430.212 still shows an error:on that test page and it uses instantiateStreaming: https://s3.amazonaws.com/webassembly-chrome-csp/csp_test.html

That is actually also already linked in WebAssembly/content-security-policy#7.

[dkasak]

There's now support for wasm-unsafe-eval in at least Firefox and Chromium, which is part of CSP Level 3 Working Draft. This directive allows unsafe-eval behaviour for WASM, but not for scripts. Unclear how widely it's supported, though.

This is another issue to pay attention as well long-term: https://bugs.chromium.org/p/chromium/issues/detail?id=961485. This discusses allowing loading WASM from same-origin sources and there's mentions of WASM potentially getting its own CSP directive (e.g. wasm-src).

[t3chguy]

This got done