CSS module scripts

Component: JSC / WebCore module loader | b1913f6

LayoutTests/imported/w3c/web-platform-tests/content-security-policy/style-src/import-style-blocked.sub-expected.txt

-Harness Error (TIMEOUT), message = null
-
-TIMEOUT import-style-blocked Test timed out
+PASS import-style-blocked

LayoutTests/imported/w3c/web-platform-tests/fetch/api/request/destination/fetch-destination.https-expected.txt

-FAIL Import declaration with `type: "css"` fetches with a "style" Request.destination promise_test: Unhandled rejection with value: "TypeError: Import attribute type \"css\" is not valid"

+PASS Import declaration with `type: "css"` fetches with a "style" Request.destination

JSC's module loader asks the embedder (WebCore) to fetch a module's source and then parses it into a module record whose type comes from the type import attribute. JSC cannot parse stylesheets, which are a WebCore construct. The fetch hook can therefore now return either source text or an opaque JSValue, which JSC trusts and installs as the module's default export.

With the CSSModuleScriptsEnabled flag (off by default), import sheet from './a.css' with { type: 'css' } and its dynamic form fetch the stylesheet with the "style" destination and style-src CSP. They then build a CSSStyleSheet via replaceSync and hand JSC a JSCSSStyleSheet. jsc, workers and worklets reject the import.

Significance

The host can now hand JSC a ready-made JSValue to install as a module export without any parsing, a new host-to-engine trust contract.

Audit directions

Audit the contract between JSModuleLoader::makeModule, ModuleRegistryEntry::provideFetch and the WebCore callers. Check: - The same specifier requested with different type attributes, and whether cached entries or JSValues can be confused across types. - GC and lifetime of the sheet between createCSSModuleScript/setCSSStyleSheet and the JSC microtasks (moduleRegistryFetchSettled, moduleLoadTopSettled), including when the document or global object is torn down mid-fetch. - Which realm the sheet is created in compared with the importing realm. - Whether any path skips moduleTypeIsAllowed. - CSP/CORS/credentials/integrity/redirect parity with script modules. - replaceSync and sheetText use on a sheet that is still loading or has a different charset or BOM.

Fuzz mixed static and dynamic imports of the same URL with a changing Content-Type, combined with detach or navigation during the fetch.