- From: Florian Rivoal via GitHub <sysbot+gh@w3.org>
- Date: Mon, 03 Dec 2018 07:49:52 +0000
- To: public-css-archive@w3.org
--- Migrated from https://github.com/WICG/spatial-navigation/issues/28#issuecomment-407793393 Originally created by @frivoal on *Wed, 25 Jul 2018 15:23:08 GMT* --- In 7.2, step 8.else.2.else means that the search for focusable or scrollable elements up the tree will cross iframe boundaries. However, the details of it mean that events don't leak information about the content of the iframe, since *starting point*, *event target* and *container* are retargetted against the iframe element itself, and no longer carry information about the elements inside the iframe's document. This means that there isn't really any information leak. Regardless of which element in the iframe was focused (or if none was focused), you'll get the same event. The only case of information leakage I think is when the author would use`window.navigate`, while the focus is in an iframe, if they don't get an event at all it means that either there was something scrollable of focusable within the iframe, as the only case where you get an event is when the search didn't find anything at all goes up the tree. This is so limited information that I don't think it introduces real security problems, but it is as far as I can tell information that you could not get otherwise. -- GitHub Notification of comment by frivoal Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/3382#issuecomment-443618289 using your GitHub account
Received on Monday, 3 December 2018 07:49:54 UTC