can we disable or remap import for a realm?

[caridy]

One thing that we have struggle with is the ability to control code executing arbitrary imports. In the realms-shim (polyfill for realms proposal) we rely on a regexp (yes, yes, we know, bugs keep coming). Additionally, when sandboxing via iframes we also struggle to prevent arbitrary import(). Since this feature is part of the grammar, there is no way to disable it, it becomes more challenging than eval. We have debated a couple of options:

1. CSP flag to signal to the host that import() should throw (this seems very bizarre and extreme)

2. Use a generic import map to point to a module that throws for all import statements, or a subject of them. This is related to Sugary defaults: can we create a simple case for advanced ahead-of-time tools? #7

{
  "imports": {
    "*": "/throw.js"
  }
}

cc @jdalton

[domenic]

This isn't in scope for import maps; controlling the execution of code on the web platform is best done via CSP.