Bug 258443 - Blob can't be read from opaque origined Workers
Summary: Blob can't be read from opaque origined Workers
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: Safari Technology Preview
Hardware: Mac (Apple Silicon) macOS 13
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-06-23 00:43 PDT by Kaiido
Modified: 2023-10-18 04:30 PDT (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kaiido 2023-06-23 00:43:18 PDT
Test-case: https://codepen.io/_-0-_/pen/qBQqbLy

Trying to read a Blob object with whatever method (`.arrayBuffer()` et al., `FileReader`, `new Response(blob).arrayBuffer()` etc.) from an opaque origin Web Worker throws an error:

> [Error] Not allowed to load local resource: blob:null/70ccdfb9-8d83-4234-aec5-c45cb251b792
> [Error] Cannot load blob:null/70ccdfb9-8d83-4234-aec5-c45cb251b792 due to access control checks.
> [Error] Failed to load resource: Not allowed to request resource (70ccdfb9-8d83-4234-aec5-c45cb251b792, line 0)
> [Error] Unhandled Promise Rejection: NotReadableError: The I/O read operation failed. (anonymous function) (data:text/javascript,%0A…%0A:3)

The issue seems to be that the fetch request made to access the blob's data goes through cross-origin checks, however the Blob should be by essence same origin, since it's supposed to be "in memory". 
This happens for Workers created from a data: URL, as well as for the ones created from a blob: URL in a file:// document.

The weird thing is that it seems to work fine for opaque origin iframes (sandboxed or data: URL).
Comment 1 Radar WebKit Bug Importer 2023-06-30 00:44:16 PDT
<rdar://problem/111555365>