Spec should clarify if data: URLs are allowed as ServiceWorker sources.

[nikhilm]

Are they allowed? I don't remember if we had consensus on it.

[jakearchibald]

Definitely not allowed. Allows for lock-in, and can get your origin hosed (worse than usual) if someone gets to inject JS onto the page.

[calvinmetcalf]

I'm assuming this would also apply to blob urls?

[jakearchibald]

Yep. The SW script can be cached, but its url must be a network resource.

[annevk]

This is covered by https://slightlyoff.github.io/ServiceWorker/spec/service_worker/#registration-algorithm (although it needs to define all the things it references much better).