I fail to see how this isn't ripe for abuse. I can execute javascript in a person's browser using your domain.
very hard for a normal person to tell the good link from a bad link, and removes the way most people determine if a link should be trusted (by looking at the domain)
The only thing I can think of is, that a service worker has it's own CSP, as opposed to obeying the CSP of the registering script, but this service doesn't use CSP anyways.
That said I couldn't get it to work. You would need to be able to register a service worker file at something like https://jstrieb.github.io/urlpages/sw.js but all the pages you have control over have proper html mime type and are rejected when you try to register them (and have too much actual html junk in them to run as js files anyway).
Just fetch it.
fetch("https://jstrieb.github.io/")
self.addEventListener('fetch', event => {
event.respondWith(
new Response('<h1>I murder kittens for fun</h1>', {
headers: {
'Content-Type': 'text/html; charset=utf-8'
}
})
);
})Or, any time this sort of thing comes up in a thread on a news website like this one, an opportunistic attacker could post a malicious payload in a link and watch as all the excited people blindly click away.
Example: Alice makes a benign page that uses location data and shares the link with her friends. The friends know what's up and grant location permissions to get the page to work.
What they actually did, however was grant location permissions to "https://jstrieb.github.io/urlpages" and any script served by that origin.
So when some of the friends later open Eve's URL that contains a location harvester, they don't get any prompt at all: Eve's link can just reuse the location permission given to Alice because, as far as the browser is concerned, both scripts belong to the same page.
https://github.com/jsfiddle/jsfiddle-issues/issues/1417
Only issue is this being deployed more widespread, Twitter may need to start scanning explicitly for this software to block it regardless of domain.
Since this has received more attention than I expected, I'd be willing to put the time in to implement this.