DISPATCH M. Miller Internet-Draft Mozilla Obsoletes: 4329 (if approved) M. Borins Intended status: Informational M. Bynens Expires: September 7, 2020 Google B. Farias March 06, 2020 ECMAScript Media Types Updates draft-ietf-dispatch-javascript-mjs-06 Abstract This document updates the ECMAScript media types, replacing the existing registrations for "application/javascript" and "text/ javascript" with information and requirements aligned with implementation experiences. This document obsoletes RFC4329, "Scripting Media Types". Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on September 7, 2020. Copyright Notice Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must Miller, et al. Expires September 7, 2020 [Page 1] Internet-Draft ECMAScript Media Types Updates March 2020 include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2. Compatibility . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4. Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4.1. Charset Parameter . . . . . . . . . . . . . . . . . . . . 4 4.2. Character Encoding Scheme Detection . . . . . . . . . . . 5 4.3. Character Encoding Scheme Error Handling . . . . . . . . 6 5. Security Considerations . . . . . . . . . . . . . . . . . . . 6 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 6.1. Common Javascript Media Types . . . . . . . . . . . . . . 9 6.1.1. text/javascript . . . . . . . . . . . . . . . . . . . 9 6.2. Historic Javascript Media Types . . . . . . . . . . . . . 10 6.2.1. application/ecmascript . . . . . . . . . . . . . . . 10 6.2.2. application/javascript . . . . . . . . . . . . . . . 11 6.2.3. application/x-ecmascript . . . . . . . . . . . . . . 12 6.2.4. application/x-javascript . . . . . . . . . . . . . . 13 6.2.5. text/ecmascript . . . . . . . . . . . . . . . . . . . 14 6.2.6. text/javascript1.0 . . . . . . . . . . . . . . . . . 15 6.2.7. text/javascript1.1 . . . . . . . . . . . . . . . . . 16 6.2.8. text/javascript1.2 . . . . . . . . . . . . . . . . . 17 6.2.9. text/javascript1.3 . . . . . . . . . . . . . . . . . 18 6.2.10. text/javascript1.4 . . . . . . . . . . . . . . . . . 19 6.2.11. text/javascript1.5 . . . . . . . . . . . . . . . . . 20 6.2.12. text/jscript . . . . . . . . . . . . . . . . . . . . 21 6.2.13. text/livescript . . . . . . . . . . . . . . . . . . . 22 6.2.14. text/x-ecmascript . . . . . . . . . . . . . . . . . . 23 6.2.15. text/x-javascript . . . . . . . . . . . . . . . . . . 24 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 25 7.1. Normative References . . . . . . . . . . . . . . . . . . 25 7.2. Informative References . . . . . . . . . . . . . . . . . 26 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 26 Appendix B. Changes from RFC 4329 . . . . . . . . . . . . . . . 26 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27 1. Introduction This memo describes media types for the JavaScript and ECMAScript programming languages. Refer to "Brief History" and "Overview" in [ECMA-262] for background information on these languages. This document updates the descriptions and registrations for these media types to reflect existing usage on the Internet. Miller, et al. Expires September 7, 2020 [Page 2] Internet-Draft ECMAScript Media Types Updates March 2020 This document replaces the media types registrations in [RFC4329], osboleting that document. 1.1. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Compatibility This document defines equivalent processing requirements for the types text/javascript, text/ecmascript, and application/javascript. The most widely supported media type in use is text/javascript; all others are considered historical and obsolete compared to text/ javascript. Differences in ECMAScript versions have been better dealt within in the processors. The types defined in this document are applicable to scripts written in [ECMA-262]. This document does not address scripts written in other languages. In particular, future editions of [ECMA-262] and extensions to [ECMA-262] are not directly addressed. This document may be updated to take other content into account. Updates of this document may introduce new optional parameters; implementations MUST consider the impact of such an update. 3. Modules In order to formalize support for modular programs, [ECMA-262] (starting with 6th Edition) defines two top-level goal symbols (or roots to the abstract syntax tree) for the ECMAScript grammar: Module and Script. The Script goal represents the more stand-alone structure where the code executes in the global scope, while the Module goal represents the module system built into ECMAScript starting with 6th Edition. This separation means that (in the absence of additional information) there are two possible interpretations for any given ECMAScript Source Text. The TC39 standards body for ECMAScript has determined that media types are outside of their scope of work [TC39-MIME-ISSUE]. It is not possible to fully determine if a Source Text of ECMAScript is meant to be parsed in the Module or Script grammar goals based upon content alone. Therefore, scripting environments must use out Miller, et al. Expires September 7, 2020 [Page 3] Internet-Draft ECMAScript Media Types Updates March 2020 of band information in order to determine what goal a Source Text should be treated as. To this end some scripting environments have chosen to adopt a new file extension of .mjs for determining the goal of a given Source Text. This document does not define how fragment identifiers in resource identifiers ([RFC3986], [RFC3987]) for documents labeled with one of the media types defined in this document are resolved. An update of this document may define processing of fragment identifiers. 4. Encoding Refer to [RFC6265] for a discussion of terminology used in this section. Source text (as defined in [ECMA-262], section "Source Text") can be binary source text. Binary source text is a textual data object that represents source text encoded using a character encoding scheme. A textual data object is a whole text protocol message or a whole text document, or a part of it, that is treated separately for purposes of external storage and retrieval. An implementation's internal representation of source text and source text are not considered binary source text. Implementations need to determine a character encoding scheme in order to decode binary source text to source text. The media types defined in this document allow an optional charset parameter to explicitly specify the character encoding scheme used to encode the source text. How implementations determine the character encoding scheme can be subject to processing rules that are out of the scope of this document. For example, transport protocols can require that a specific character encoding scheme is to be assumed if the optional charset parameter is not specified, or they can require that the charset parameter is used in certain cases. Such requirements are not considered part of this document. Implementations that support binary source text MUST support binary source text encoded using the UTF-8 [RFC3629] character encoding scheme. Other character encoding schemes MAY be supported. Use of UTF-8 to encode binary source text is encouraged but not required. 4.1. Charset Parameter The charset parameter provides a means to specify the character encoding scheme of binary source text. Its value MUST match the mime-charset production defined in [RFC2978], section 2.3, and SHOULD be a registered charset [CHARSETS]. An illegal value is a value that does not match that production. Miller, et al. Expires September 7, 2020 [Page 4] Internet-Draft ECMAScript Media Types Updates March 2020 4.2. Character Encoding Scheme Detection It is possible that implementations cannot interoperably determine a single character encoding scheme simply by complying with all requirements of the applicable specifications. To foster interoperability in such cases, the following algorithm is defined. Implementations apply this algorithm until a single character encoding scheme is determined. 1. If a charset parameter with a legal value is specified, the value determines the character encoding scheme. 2. If the binary source text starts with a Unicode encoding form signature, the signature determines the encoding. The following octet sequences, at the very beginning of the binary source text, are considered with their corresponding character encoding schemes: +------------------+----------+ | Leading sequence | Encoding | |------------------+----------| | FF FE 00 00 | UTF-32LE | | 00 00 FE FF | UTF-32BE | | FF FE | UTF-16LE | | FE FF | UTF-16BE | | EF BB BF | UTF-8 | +------------------+----------+ The longest matching octet sequence determines the encoding. Implementations of this step MUST use these octet sequences to determine the character encoding scheme, even if the determined scheme is not supported. If this step determines the character encoding scheme, the octet sequence representing the Unicode encoding form signature MUST be ignored when decoding the binary source text to source text. 3. The character encoding scheme is determined to be UTF-8. If the character encoding scheme is determined to be UTF-8 through any means other than step 2 as defined above and the binary source text starts with the octet sequence EF BB BF, the octet sequence is ignored when decoding the binary source text to source text. (The sequence will also be ignored if step 2 determines the character encoding scheme per the requirements in step 2). Miller, et al. Expires September 7, 2020 [Page 5] Internet-Draft ECMAScript Media Types Updates March 2020 4.3. Character Encoding Scheme Error Handling The following error processing behavior is RECOMMENDED: o If the value of a charset parameter is illegal, implementations MUST either recover from the error by ignoring the parameter or consider the character encoding scheme unsupported. o If binary source text is determined to have been encoded using a certain character encoding scheme that the implementation is unable to process, implementations MUST consider the resource unsupported (i.e., they MUST NOT decode the binary source text using a different character encoding scheme). o Binary source text can be determined to have been encoded using a certain character encoding scheme but contain octet sequences that are not legal according to that scheme. This is typically caused by a lack of proper character encoding scheme information; such errors can pose a security risk, as discussed in section 5. Implementations SHOULD detect such errors as early as possible; in particular, they SHOULD detect them before interpreting any of the source text. Implementations MUST detect such errors and MUST NOT interpret any source text after detecting such an error. Such errors MAY be reported, e.g., as syntax errors as defined in [ECMA-262], section 16. This document does not define facilities that allow specification of the character encoding scheme used to encode binary source text in a conflicting manner. There are only two sources for character encoding scheme information: the charset parameter and the Unicode encoding form signature. If a charset parameter is specified, binary source text is processed as defined for that character encoding scheme. 5. Security Considerations Refer to [RFC3552] for a discussion of terminology used in this section. Examples in this section and discussions of interactions of host environments with scripts, modules, and extensions to [ECMA-262] are to be understood as non-exhaustive and of a purely illustrative nature. The programming language defined in [ECMA-262] is not intended to be computationally self-sufficient, rather it is expected that the computational environment provides facilities to programs to enable specific functionality. Such facilities constitute unknown factors and are thus considered out of the scope of this document. Miller, et al. Expires September 7, 2020 [Page 6] Internet-Draft ECMAScript Media Types Updates March 2020 Derived programming languages are permitted to include additional functionality that is not described in [ECMA-262]; such functionality constitutes an unknown factor and is thus considered out of the scope of this document. In particular, extensions to [ECMA-262] defined for the JavaScript programming language are not discussed in this document. Uncontrolled execution of scripts can be exceedingly dangerous. Implementations that execute scripts MUST give consideration to their application's threat models and those of the individual features they implement; in particular, they MUST ensure that untrusted content is not executed in an unprotected environment. Module scripts in ECMAScript can request the fetching and processing of additional scripts, called importing. Implementations that support modules need to ensure these scripts are processed the same as scripts processed directly. Further, there may be additional privacy and security concerns depending on the location(s) the original script and its imported modules are obtained from. For instance, a scripted obtained from "host-a.example" could request to import a script from "host-b.example", which could expose information about the executing environment (e.g., IP address) to "host- b.example". With the addition of SharedArrayBuffer objects in ECMAScript version 8, it may be possible to implement a high-resolution timer which could lead to certain types of timing and side-channel attacks (e.g., [SPECTRE]). Implementations may wish to take steps to mitigate this concern, such as disabling or removing support for SharedArrayBuffer objects, or take additional steps to ensure access to this shared memory is only accessible between execution contexts that have some form of mutual trust. Specifications for host environment facilities and for derived programming languages should include security considerations. If an implementation supports such facilities, the respective security considerations apply. In particular, if scripts can be referenced from or included in specific document formats, the considerations for the embedding or referencing document format apply. For example, scripts embedded in application/xhtml+xml [RFC3236] documents could be enabled through the host environment to manipulate the document instance, which could cause the retrieval of remote resources; security considerations regarding retrieval of remote resources of the embedding document would apply in this case. This circumstance can further be used to make information, that is normally only available to the script, available to a web server by Miller, et al. Expires September 7, 2020 [Page 7] Internet-Draft ECMAScript Media Types Updates March 2020 encoding the information in the resource identifier of the resource, which can further enable eavesdropping attacks. Implementation of such facilities is subject to the security considerations of the host environment, as discussed above. The programming language defined in [ECMA-262] does include facilities to loop, cause computationally complex operations, or consume large amounts of memory; this includes, but is not limited to, facilities that allow dynamically generated source text to be executed (e.g., the eval() function); uncontrolled execution of such features can cause denial of service, which implementations MUST protect against. A host environment can provide facilities to access external input. Scripts that pass such input to the eval() function or similar language features can be vulnerable to code injection attacks. Scripts are expected to protect against such attacks. A host environment can provide facilities to output computed results in a user-visible manner. For example, host environments supporting a graphical user interface can provide facilities that enable scripts to present certain messages to the user. Implementations MUST take steps to avoid confusion of the origin of such messages. In general, the security considerations for the host environment apply in such a case as discussed above. Implementations are required to support the UTF-8 character encoding scheme; the security considerations of [RFC3629] apply. Additional character encoding schemes may be supported; support for such schemes is subject to the security considerations of those schemes. Source text is expected to be in Unicode Normalization Form C. Scripts and implementations MUST consider security implications of unnormalized source text and data. For a detailed discussion of such implications refer to the security considerations in [RFC3629]. Scripts can be executed in an environment that is vulnerable to code injection attacks. For example, a CGI script [RFC3875] echoing user input could allow the inclusion of untrusted scripts that could be executed in an otherwise trusted environment. This threat scenario is subject to security considerations that are out of the scope of this document. The "data" resource identifier scheme [RFC2397], in combination with the types defined in this document, could be used to cause execution of untrusted scripts through the inclusion of untrusted resource identifiers in otherwise trusted content. Security considerations of [RFC2397] apply. Miller, et al. Expires September 7, 2020 [Page 8] Internet-Draft ECMAScript Media Types Updates March 2020 Implementations can fail to implement a specific security model or other means to prevent possibly dangerous operations. Such failure could possibly be exploited to gain unauthorized access to a system or sensitive information; such failure constitutes an unknown factor and is thus considered out of the scope of this document. 6. IANA Considerations The media type registrations herein are divided into two major categories: the sole media type "text/javascript" which is now in common usage, and all of the media types that are obsolete. For both categories, The ECMAScript media types are to be updated to point to a non-vendor specific standard undated specification of ECMAScript. In addition, a new file extension of .mjs is to be added to the list of file extensions with the restriction that it must correspond to the Module grammar of [ECMA-262]. Finally, the [HTML] specification uses "text/javascript" as the default media type of ECMAScript when preparing script tags; therefore, "text/javascript" intended usage is to be moved from OBSOLETE to COMMON. 6.1. Common Javascript Media Types 6.1.1. text/javascript Type name: text Subtype name: javascript Required parameters: N/A Optional parameters: charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a Miller, et al. Expires September 7, 2020 [Page 9] Internet-Draft ECMAScript Media Types Updates March 2020 File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: COMMON Restrictions on usage: The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2. Historic Javascript Media Types The following media types are added or updated for historical purposes. All herein have an intended usage of OBSOLETE, and are not expected to be in use with modern implementations. 6.2.1. application/ecmascript Type name: application Subtype name: ecmascript Required parameters: N/A Optional parameters: charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Miller, et al. Expires September 7, 2020 [Page 10] Internet-Draft ECMAScript Media Types Updates March 2020 Magic number(s): n/a File extension(s): .es, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.2. application/javascript Type name: application Subtype name: javascript Required parameters: N/A Optional parameters: charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: charset, see section 4.1 of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a Miller, et al. Expires September 7, 2020 [Page 11] Internet-Draft ECMAScript Media Types Updates March 2020 File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG . 6.2.3. application/x-ecmascript Type name: application Subtype name: x-ecmascript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .es, .mjs Miller, et al. Expires September 7, 2020 [Page 12] Internet-Draft ECMAScript Media Types Updates March 2020 Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.4. application/x-javascript Type name: application Subtype name: x-javascript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Miller, et al. Expires September 7, 2020 [Page 13] Internet-Draft ECMAScript Media Types Updates March 2020 Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.5. text/ecmascript Type name: text Subtype name: ecmascript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .es, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Miller, et al. Expires September 7, 2020 [Page 14] Internet-Draft ECMAScript Media Types Updates March 2020 Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.6. text/javascript1.0 Type name: text Subtype name: javascript1.0 Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Miller, et al. Expires September 7, 2020 [Page 15] Internet-Draft ECMAScript Media Types Updates March 2020 Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.7. text/javascript1.1 Type name: text Subtype name: javascript1.1 Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ Miller, et al. Expires September 7, 2020 [Page 16] Internet-Draft ECMAScript Media Types Updates March 2020 ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.8. text/javascript1.2 Type name: text Subtype name: javascript1.2 Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that Miller, et al. Expires September 7, 2020 [Page 17] Internet-Draft ECMAScript Media Types Updates March 2020 rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG 6.2.9. text/javascript1.3 Type name: text Subtype name: javascript1.3 Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Miller, et al. Expires September 7, 2020 [Page 18] Internet-Draft ECMAScript Media Types Updates March 2020 Author: See Author's Address section of [this document]. Change controller: IESG 6.2.10. text/javascript1.4 Type name: text Subtype name: javascript1.4 Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Miller, et al. Expires September 7, 2020 [Page 19] Internet-Draft ECMAScript Media Types Updates March 2020 Change controller: IESG 6.2.11. text/javascript1.5 Type name: text Subtype name: javascript1.5 Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: This media type is obsolete; current implementations should use text/javascript as the only JavaScript/ ECMAScript media type. The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG Miller, et al. Expires September 7, 2020 [Page 20] Internet-Draft ECMAScript Media Types Updates March 2020 6.2.12. text/jscript Type name: text Subtype name: jscript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG Miller, et al. Expires September 7, 2020 [Page 21] Internet-Draft ECMAScript Media Types Updates March 2020 6.2.13. text/livescript Type name: text Subtype name: livescript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG Miller, et al. Expires September 7, 2020 [Page 22] Internet-Draft ECMAScript Media Types Updates March 2020 6.2.14. text/x-ecmascript Type name: text Subtype name: x-ecmascript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .es, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG Miller, et al. Expires September 7, 2020 [Page 23] Internet-Draft ECMAScript Media Types Updates March 2020 6.2.15. text/x-javascript Type name: text Subtype name: x-javascript Required parameters: N/A Optional parameters: : charset, see section 4.1 of [this document]. Encoding considerations: Binary Security considerations: See section 5 of [this document].. Interoperability considerations: See various sections of [this document]. Published specification: [this document] Applications which use this media type: Script interpreters as discussed in [this document]. Additional information: Magic number(s): n/a File extension(s): .js, .mjs Macintosh File Type Code(s): TEXT Person & email address to contact for further information: See Author's Address section of [this document]. Intended usage: OBSOLETE Restrictions on usage: The .mjs file extension signals that the file represents a JavaScript module. Execution environments that rely on file extensions to determine how to process inputs parse .mjs files using the Module grammar of [ECMA-262]. Author: See Author's Address section of [this document]. Change controller: IESG Miller, et al. Expires September 7, 2020 [Page 24] Internet-Draft ECMAScript Media Types Updates March 2020 7. References 7.1. Normative References [CHARSETS] IANA, "Assigned character sets", n.d., . [ECMA-262] Ecma International, "Standard ECMA-262: ECMAScript Language Specification", June 2019, . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC2397] Masinter, L., "The "data" URL scheme", RFC 2397, DOI 10.17487/RFC2397, August 1998, . [RFC2978] Freed, N. and J. Postel, "IANA Charset Registration Procedures", BCP 19, RFC 2978, DOI 10.17487/RFC2978, October 2000, . [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, . [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2003, . [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, . [RFC3987] Duerst, M. and M. Suignard, "Internationalized Resource Identifiers (IRIs)", RFC 3987, DOI 10.17487/RFC3987, January 2005, . [RFC4329] Hoehrmann, B., "Scripting Media Types", RFC 4329, DOI 10.17487/RFC4329, April 2006, . Miller, et al. Expires September 7, 2020 [Page 25] Internet-Draft ECMAScript Media Types Updates March 2020 [RFC6265] Barth, A., "HTTP State Management Mechanism", RFC 6265, DOI 10.17487/RFC6265, April 2011, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . 7.2. Informative References [HTML] WHATWG, "HTML Living Standard", August 2017, . [RFC3236] Baker, M. and P. Stark, "The 'application/xhtml+xml' Media Type", RFC 3236, DOI 10.17487/RFC3236, January 2002, . [RFC3875] Robinson, D. and K. Coar, "The Common Gateway Interface (CGI) Version 1.1", RFC 3875, DOI 10.17487/RFC3875, October 2004, . [SPECTRE] Kocher, P., Fogh, A., Gerkin, D., Gruss, D., Haas, W., Hamburg, M., Lipp, M., Mangard, S., Prescher, T., Schwarz, M., and Y. Yarom, "Spectre Attacks: Exploiting Speculative Execution", January 2018, . [TC39-MIME-ISSUE] TC39, "Add `application/javascript+module` mime to remove ambiguity", August 2017, . Appendix A. Acknowledgements This work builds upon its antecedent document, authored by Bjoern Hoehrmann. The authors would like to thank Adam Roach, Anna van Kesteren, Allen Wirfs-Brock, Alexey Melnikov, James Snell, Mark Nottingham, Murray Kucherawy, and Suresh Krishnan for their guidance and feedback throughout this process. Appendix B. Changes from RFC 4329 o Added a section discussing ECMAscript modules and the impact on processing. o Updated the Security Considerations to discuss concerns associated with ECMAscript modules and SharedArrayBuffers. Miller, et al. Expires September 7, 2020 [Page 26] Internet-Draft ECMAScript Media Types Updates March 2020 o Updated the character encoding scheme detection to remove normative guidance on its use, to better reflect operational reality. o Changed the intended usage of the media type text/javascript from obsolete to common. o Changed the intended usage for all other script media types to obsolete. o Updated various references where the original has been osboleted o Updated references to ECMA-262 to match the version at time of publication. Authors' Addresses Matthew A. Miller Mozilla Email: linuxwolf+ietf@outer-planes.net Myles Borins Google Email: mylesborins@google.com Mathias Bynens Google Email: mths@google.com Bradley Farias Email: bradley.meck@gmail.com Miller, et al. Expires September 7, 2020 [Page 27]