From 0b21a83d6b9305f8c4ad172528ab804a57d7cb05 Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Fri, 19 Nov 2021 12:07:53 -0800 Subject: [PATCH 01/10] Prevent modules from being imported with a type: 'javascript' assertion. --- source | 72 +++++++++++++++++++++++++++++++++------------------------- 1 file changed, 41 insertions(+), 31 deletions(-) diff --git a/source b/source index 234caa8a2f8..41113924d06 100644 --- a/source +++ b/source @@ -91374,10 +91374,8 @@ document.querySelector("button").addEventListener("click", bound); we only asked for "type" assertions in HostGetSupportedImportAssertions.

-

  • If moduleRequest.[[Assertions]] has a Record entry - such that entry.[[Key]] is "type", then let module - type be entry.[[Value]]. Otherwise let module type be "javascript".

    • +

  • Let module type be the result of running the module type from module + request steps given moduleRequest.

  • If the result of running the module type allowed steps given module type and settings object is false, then asynchronously complete this algorithm @@ -91741,10 +91739,8 @@ document.querySelector("button").addEventListener("click", bound); href="#validate-requested-module-specifiers">previously successful with these same two arguments.

    • -

  • If requested.[[Assertions]] has a Record entry such - that entry.[[Key]] is "type", then let module type - be entry.[[Value]]. Otherwise let module type be "javascript".

    • +

  • Let module type be the result of running the module type from module + request steps given requested.

  • If visited set does not contain @@ -91807,10 +91803,8 @@ document.querySelector("button").addEventListener("click", bound); href="#validate-requested-module-specifiers">previously successful with these same two arguments.

    • -

  • If moduleRequest.[[Assertions]] has a Record entry - such that entry.[[Key]] is "type", then let module - type be entry.[[Value]]. Otherwise let module type be "javascript".

    • +

  • Let module type be the result of running the module type from module + request steps given moduleRequest.

  • Assert: visited set contains (url, module type).

    • @@ -91846,17 +91840,9 @@ document.querySelector("button").addEventListener("click", bound);

    1. Let module type be "javascript".

      2. -
    2. -

      If moduleRequest was given and moduleRequest.[[Assertions]] has a - Record entry such that entry.[[Key]] is "type", then:

      - -
        -

      1. Assert: No more than one such Record exists.

        2. - -

      2. Set module type to entry.[[Value]].

        3. -
      -
      3. +

    3. If moduleRequest was given, then set module type to the result of + running the module type from module request steps given + moduleRequest.

    4. Assert: the result of running the module type allowed steps given module type and module map settings object is true. Otherwise we would not have reached @@ -92004,10 +91990,8 @@ document.querySelector("button").addEventListener("click", bound); href="#validate-requested-module-specifiers">marked as itself having a parse error.)

      5. -

    5. If moduleRequest.[[Assertions]] has a Record entry - such that entry.[[Key]] is "type", then let module - type be entry.[[Value]]. Otherwise let module type be "javascript".

      6. +

    6. Let module type be the result of running the module type from module + request steps given moduleRequest.

    7. Let childModule be moduleMap[(childURL, module type)].

      8. @@ -92153,10 +92137,8 @@ document.querySelector("button").addEventListener("click", bound); a module specifier given script's base URL and requested.[[Specifier]].

      -

    8. If requested.[[Assertions]] has a Record entry such - that entry.[[Key]] is "type", then let module type - be entry.[[Value]]. Otherwise let module type be "javascript".

      9. +

    9. Let module type be the result of running the module type from module + request steps given requested.

    10. If url is failure, or if the result of running the module type @@ -92252,6 +92234,34 @@ document.querySelector("button").addEventListener("click", bound);

    11. Return script.

    +

    The module type from module request steps, given a ModuleRequest + Record moduleRequest, are as follows:

    + +
      +

    1. Let module type be "javascript".

      2. + +
    2. +

      If moduleRequest.[[Assertions]] has a Record entry such + that entry.[[Key]] is "type", then:

      + +
        +
      1. +

        If entry.[[Value]] is "javascript", then set + module type to null.

        + +

        This specification uses the "javascript" module type + internally for JavaScript module scripts, so + this step is needed to prevent modules from being imported using a "javascript" type assertion.

        +
        2. + +

      2. Otherwise, set module type to entry.[[Value]].

        3. +
      +
      3. + +

    3. Return module type.

      4. +
    +

    The module type allowed steps, given a string module type and an environment settings object settings, are as follows:

    From 1166785cf9538ba0cb3f0a2a8b46d4bd5156b2fc Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Fri, 19 Nov 2021 13:59:27 -0800 Subject: [PATCH 02/10] Clarify that null module type will cause module allowed check to fail --- source | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/source b/source index 41113924d06..200e0151ec7 100644 --- a/source +++ b/source @@ -92252,7 +92252,8 @@ document.querySelector("button").addEventListener("click", bound);

    This specification uses the "javascript" module type internally for JavaScript module scripts, so this step is needed to prevent modules from being imported using a "javascript" type assertion.

    + data-x="">javascript" type assertion (a null module type will cause the + module type allowed check to fail).

  • Otherwise, set module type to entry.[[Value]].

    • From 8ed198c4a75bbd4fb6d258c0b4e11e3d44c47aa4 Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Mon, 22 Nov 2021 16:33:07 -0800 Subject: [PATCH 03/10] module type --> moduleType --- source | 95 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 48 insertions(+), 47 deletions(-) diff --git a/source b/source index 200e0151ec7..b3cdc66c3f7 100644 --- a/source +++ b/source @@ -91374,12 +91374,12 @@ document.querySelector("button").addEventListener("click", bound); we only asked for "type" assertions in HostGetSupportedImportAssertions.

    -

  • Let module type be the result of running the module type from module +

  • Let moduleType be the result of running the module type from module request steps given moduleRequest.

    • -

  • If the result of running the module type allowed steps given module - type and settings object is false, then asynchronously complete this algorithm - with null, and return.

    • +

  • If the result of running the module type allowed steps given + moduleType and settings object is false, then asynchronously complete this + algorithm with null, and return.

  • Fetch a single module script given url, settings object, "script", options, settings object, @@ -91391,7 +91391,7 @@ document.querySelector("button").addEventListener("click", bound);

  • If result is null, asynchronously complete this algorithm with null, and return.

    • -

  • Let visited set be « (url, module type) ».

    • +

  • Let visited set be « (url, moduleType) ».

  • Fetch the descendants of and link result given settings object, @@ -91739,18 +91739,18 @@ document.querySelector("button").addEventListener("click", bound); href="#validate-requested-module-specifiers">previously successful with these same two arguments.

    • -

  • Let module type be the result of running the module type from module +

  • Let moduleType be the result of running the module type from module request steps given requested.

  • If visited set does not contain - (url, module type), then:

    + (url, moduleType), then:

    1. Append requested to moduleRequests.

      2. -

    2. Append (url, module type) to +

    3. Append (url, moduleType) to visited set.

    • @@ -91803,11 +91803,11 @@ document.querySelector("button").addEventListener("click", bound); href="#validate-requested-module-specifiers">previously successful with these same two arguments.

    -

  • Let module type be the result of running the module type from module +

  • Let moduleType be the result of running the module type from module request steps given moduleRequest.

  • Assert: visited set contains - (url, module type).

    • + (url, moduleType).

  • Fetch a single module script given url, fetch client settings object, destination, options, module map settings object, @@ -91838,15 +91838,15 @@ document.querySelector("button").addEventListener("click", bound); complete with either null (on failure) or a module script (on success).

      -

    1. Let module type be "javascript".

      2. +

    2. Let moduleType be "javascript".

      3. -

    3. If moduleRequest was given, then set module type to the result of +

    4. If moduleRequest was given, then set moduleType to the result of running the module type from module request steps given moduleRequest.

      5. -

    5. Assert: the result of running the module type allowed steps given module - type and module map settings object is true. Otherwise we would not have reached - this point because a failure would have been raised when inspecting +

    6. Assert: the result of running the module type allowed steps given + moduleType and module map settings object is true. Otherwise we would not + have reached this point because a failure would have been raised when inspecting moduleRequest.[[Assertions]] in create a JavaScript module script or fetch an import() module script graph.

      7. @@ -91854,17 +91854,17 @@ document.querySelector("button").addEventListener("click", bound);

    7. Let moduleMap be module map settings object's module map.

      8. -

    8. If moduleMap[(url, module type)] is +

    9. If moduleMap[(url, moduleType)] is "fetching", wait in parallel until that entry's value changes, then queue a task on the networking task source to proceed with running the following steps.

      10. -

    10. If moduleMap[(url, module type)]

      If moduleMap[(url, moduleType)] exists, asynchronously complete this algorithm with - moduleMap[url / module type], and return.

      11. + moduleMap[url / moduleType], and return.

      -

    11. Set moduleMap[(url, module - type)] to "fetching".

      12. +

    12. Set moduleMap[(url, + moduleType)] to "fetching".

    13. Let request be a new request whose URL is url, ok status.

      14. -

      then set moduleMap[(url, module - type)] to null, asynchronously complete this algorithm with null, and return.

      +

      then set moduleMap[(url, + moduleType)] to null, asynchronously complete this algorithm with null, and + return.

    14. Let source text be the result of UTF-8 @@ -91927,26 +91928,26 @@ document.querySelector("button").addEventListener("click", bound);

    15. Let module script be null.

      16. -

    16. If MIME type is a JavaScript MIME type and module type +

    17. If MIME type is a JavaScript MIME type and moduleType is "javascript", then set module script to the result of creating a JavaScript module script given source text, module map settings object, response's url, and options.

    18. If the MIME type essence of MIME type is "text/css" - and module type is "css", then set module script to + and moduleType is "css", then set module script to the result of creating a CSS module script given source text and module map settings object.

      19. -

    19. If MIME type essence is a JSON MIME type and module - type is "json", then set module script to the result of +

    20. If MIME type essence is a JSON MIME type and moduleType + is "json", then set module script to the result of creating a JSON module script given source text and module map settings object.

    21. -

      Set moduleMap[(url, module - type)] to module script, and asynchronously complete this algorithm with - module script.

      +

      Set moduleMap[(url, + moduleType)] to module script, and asynchronously complete this algorithm + with module script.

      It is intentional that the module map is keyed by the request URL, whereas the marked as itself having a parse error.)

      22. -

    22. Let module type be the result of running the module type from module +

    23. Let moduleType be the result of running the module type from module request steps given moduleRequest.

      24. -

    24. Let childModule be moduleMap[(childURL, module - type)].

      25. +

    25. Let childModule be moduleMap[(childURL, + moduleType)].

    26. Assert: childModule is a module script (i.e., it is not "fetching" or null); by now all module @@ -92137,12 +92138,12 @@ document.querySelector("button").addEventListener("click", bound); a module specifier given script's base URL and requested.[[Specifier]].

      27. -

    27. Let module type be the result of running the module type from module +

    28. Let moduleType be the result of running the module type from module request steps given requested.

    29. If url is failure, or if the result of running the module type - allowed steps given module type and settings is false, then:

      + allowed steps given moduleType and settings is false, then:

      1. Let error be a new TypeError exception.

        2. @@ -92238,7 +92239,7 @@ document.querySelector("button").addEventListener("click", bound); Record moduleRequest, are as follows:

          -

        1. Let module type be "javascript".

          2. +

        2. Let moduleType be "javascript".

        3. If moduleRequest.[[Assertions]] has a Record entry such @@ -92247,30 +92248,30 @@ document.querySelector("button").addEventListener("click", bound);

          1. If entry.[[Value]] is "javascript", then set - module type to null.

            + moduleType to null.

            This specification uses the "javascript" module type internally for JavaScript module scripts, so this step is needed to prevent modules from being imported using a "javascript" type assertion (a null module type will cause the + data-x="">javascript" type assertion (a null moduleType will cause the module type allowed check to fail).

            2. -

          2. Otherwise, set module type to entry.[[Value]].

            3. +

          3. Otherwise, set moduleType to entry.[[Value]].

          4. -

        4. Return module type.

          5. +

        5. Return moduleType.

        -

        The module type allowed steps, given a string module type +

        The module type allowed steps, given a string moduleType and an environment settings object settings, are as follows:

          -

        1. If module type is not "javascript", "

          If moduleType is not "javascript", "css", or "json", then return false.

          2. -

        2. If module type is "css" and the +

        3. If moduleType is "css" and the CSSStyleSheet interface is not exposed in setting's Realm, then return false.

          4. @@ -93413,13 +93414,13 @@ import "https://example.com/foo/../module2.mjs";           corresponding module script, or in fetch an import() module script graph).

        4. If moduleRequest.[[Assertions]] has a Record entry such - that entry.[[Key]] is "type", then let module type - be entry.[[Value]]. Otherwise let module type be "entry.[[Key]] is "type", then let moduleType + be entry.[[Value]]. Otherwise let moduleType be "javascript".

          5. -

        5. Let resolved module script be moduleMap[(url, module - type)]. (This entry must exist for us to have gotten to - this point.)

          6. +

        6. Let resolved module script be moduleMap[(url, + moduleType)]. (This entry must exist for us to have + gotten to this point.)

        7. Assert: resolved module script is a module script (i.e., is not null or "fetching").

          8. From 26d7fec6256b7864c773420cfd999f0b7d634010 Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Mon, 22 Nov 2021 16:36:04 -0800 Subject: [PATCH 04/10] Convert another instance I missed to use 'module type from module request' --- source | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/source b/source index b3cdc66c3f7..fe70a7c8bc3 100644 --- a/source +++ b/source @@ -93413,10 +93413,8 @@ import "https://example.com/foo/../module2.mjs";           same two arguments (either while creating the corresponding module script, or in fetch an import() module script graph).

          -

        8. If moduleRequest.[[Assertions]] has a Record entry such - that entry.[[Key]] is "type", then let moduleType - be entry.[[Value]]. Otherwise let moduleType be "javascript".

          9. +

        9. Let moduleType be the result of running the module type from module + request steps given moduleRequest.

        10. Let resolved module script be moduleMap[(url, moduleType)]. (This entry must exist for us to have From 0bcfc126a13e69d91de7bdf23e634d11a0941fac Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Mon, 22 Nov 2021 17:05:36 -0800 Subject: [PATCH 05/10] Add explanatory note that JS type assertions fail --- source | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/source b/source index fe70a7c8bc3..b125fd20ee1 100644 --- a/source +++ b/source @@ -58801,6 +58801,21 @@ o............A....e where this script element appears in the document, it will not be evaluated until both document parsing has complete and its dependency (dom-utils.mjs) has been fetched and evaluated.

          + +

          JavaScript module scripts are the default import type when importing from another JavaScript + module; that is, when an import statement lacks a "type" import assertion the import's type will + be JavaScript. Attempting to import a JavaScript resource using an import statement with a "type" + import assertion will fai:

          + + 
          <script type="module">
+   // All of the following will fail, assuming that the imported mjs files are served with a
+   // JavaScript MIME type. JavaScript module scripts are the default and cannot be imported with
+   // any import assertion.
+   import foo from "./bar.mjs" assert { type: "javascript" };
+   import foo2 from "./bar2.mjs" assert { type: "js" };
+   import foo3 from "./bar3.mjs" assert { type: "" };
+   await import("./bar4.mjs", { assert: { type: null } });
+</script>
          From d888653e86fe4056dbd36dd6ea443a935f15756b Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Tue, 23 Nov 2021 10:13:39 -0800 Subject: [PATCH 06/10] Typo fixes (it won't let me commit these directly on the PR UI) --- source | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source b/source index b125fd20ee1..c8aa3970e97 100644 --- a/source +++ b/source @@ -58805,12 +58805,12 @@ o............A....e

          JavaScript module scripts are the default import type when importing from another JavaScript module; that is, when an import statement lacks a "type" import assertion the import's type will be JavaScript. Attempting to import a JavaScript resource using an import statement with a "type" - import assertion will fai:

          + import assertion will fail:

          <script type="module">
-   // All of the following will fail, assuming that the imported mjs files are served with a
+   // All of the following will fail, assuming that the imported .mjs files are served with a
    // JavaScript MIME type. JavaScript module scripts are the default and cannot be imported with
-   // any import assertion.
+   // any import type assertion.
    import foo from "./bar.mjs" assert { type: "javascript" };
    import foo2 from "./bar2.mjs" assert { type: "js" };
    import foo3 from "./bar3.mjs" assert { type: "" };

From 64f51097521b8a83d41d35fefbe590052e5b68a9 Mon Sep 17 00:00:00 2001
From: Dan Clark 
Date: Tue, 23 Nov 2021 10:14:31 -0800
Subject: [PATCH 07/10] Add 'undefined' type assertion example

---
 source | 1 +
 1 file changed, 1 insertion(+)

diff --git a/source b/source
index c8aa3970e97..c04cc72893d 100644
--- a/source
+++ b/source
@@ -58815,6 +58815,7 @@ o............A....e
    import foo2 from "./bar2.mjs" assert { type: "js" };
    import foo3 from "./bar3.mjs" assert { type: "" };
    await import("./bar4.mjs", { assert: { type: null } });
+   await import("./bar5.mjs", { assert: { type: undefined } });
 </script>
          From da0df92fac51309e7b229492b46f6d6b2357c44e Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Tue, 23 Nov 2021 11:44:56 -0800 Subject: [PATCH 08/10] setting's --> settings's --- source | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source b/source index c04cc72893d..3c76975df40 100644 --- a/source +++ b/source @@ -92289,7 +92289,7 @@ document.querySelector("button").addEventListener("click", bound);

        11. If moduleType is "css" and the CSSStyleSheet interface is not exposed in - setting's Realm, then + settings's Realm, then return false.

        12. Return true.

          13. From 7adb68d0282a88309ea686ac2c8311a8843e26cf Mon Sep 17 00:00:00 2001 From: Dan Clark Date: Tue, 23 Nov 2021 12:00:52 -0800 Subject: [PATCH 09/10] Move example to module-map section. Give import/type styling where appropriate. --- source | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/source b/source index 3c76975df40..dace02e8481 100644 --- a/source +++ b/source @@ -58801,22 +58801,6 @@ o............A....e where this script element appears in the document, it will not be evaluated until both document parsing has complete and its dependency (dom-utils.mjs) has been fetched and evaluated.

          - -

          JavaScript module scripts are the default import type when importing from another JavaScript - module; that is, when an import statement lacks a "type" import assertion the import's type will - be JavaScript. Attempting to import a JavaScript resource using an import statement with a "type" - import assertion will fail:

          - - 
          <script type="module">
-   // All of the following will fail, assuming that the imported .mjs files are served with a
-   // JavaScript MIME type. JavaScript module scripts are the default and cannot be imported with
-   // any import type assertion.
-   import foo from "./bar.mjs" assert { type: "javascript" };
-   import foo2 from "./bar2.mjs" assert { type: "js" };
-   import foo3 from "./bar3.mjs" assert { type: "" };
-   await import("./bar4.mjs", { assert: { type: null } });
-   await import("./bar5.mjs", { assert: { type: undefined } });
-</script>
          @@ -93192,6 +93176,25 @@ import "https://example.com/foo/../module2.mjs"; the correct type from succeeding.

          +
          +

          JavaScript module scripts are the default import type when importing from another JavaScript + module; that is, when an import statement lacks a type import assertion the import's type will be + JavaScript. Attempting to import a JavaScript resource using an import + statement with a type import assertion will fail:

          + + 
          <script type="module">
+    // All of the following will fail, assuming that the imported .mjs files are served with a
+    // JavaScript MIME type. JavaScript module scripts are the default and cannot be imported with
+    // any import type assertion.
+    import foo from "./foo.mjs" assert { type: "javascript" };
+    import foo2 from "./foo2.mjs" assert { type: "js" };
+    import foo3 from "./foo3.mjs" assert { type: "" };
+    await import("./foo4.mjs", { assert: { type: null } });
+    await import("./foo5.mjs", { assert: { type: undefined } });
+</script>
          +
          +

          To resolve a module specifier given a URL base URL and a From a7ff72672b53acc5e3f74416d51ad3b072fc2bb8 Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Tue, 23 Nov 2021 16:11:00 -0500 Subject: [PATCH 10/10] Nit --- source | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source b/source index dace02e8481..79148642b9a 100644 --- a/source +++ b/source @@ -93179,9 +93179,9 @@ import "https://example.com/foo/../module2.mjs";

          JavaScript module scripts are the default import type when importing from another JavaScript module; that is, when an import statement lacks a type import assertion the import's type will be - JavaScript. Attempting to import a JavaScript resource using an import - statement with a type import assertion will fail:

          + data-x="">type import assertion the imported module script's type will be JavaScript. + Attempting to import a JavaScript resource using an import statement with + a type import assertion will fail:

          <script type="module">
     // All of the following will fail, assuming that the imported .mjs files are served with a