- From: Ian Hickson via cvs-syncmail <cvsmail@w3.org>
- Date: Thu, 26 Aug 2010 01:47:06 +0000
- To: public-html-commits@w3.org
Update of /sources/public/html5/spec In directory hutz:/tmp/cvs-serv16621 Modified Files: Overview.html Log Message: rel=stylesheet should only override HTTP same-origin, to avoid cross-origin data theft (whatwg r5353) Index: Overview.html =================================================================== RCS file: /sources/public/html5/spec/Overview.html,v retrieving revision 1.4269 retrieving revision 1.4270 diff -u -d -r1.4269 -r1.4270 --- Overview.html 26 Aug 2010 00:54:02 -0000 1.4269 +++ Overview.html 26 Aug 2010 01:47:02 -0000 1.4270 @@ -39876,9 +39876,11 @@ <code><a href="#the-link-element">link</a></code> element, with a non-empty value.<p>The default type for resources given by the <code title="rel-stylesheet"><a href="#link-type-stylesheet">stylesheet</a></code> keyword is <code title="">text/css</code>.<div class="impl"> <p><strong>Quirk</strong>: If the document has been set to - <a href="#quirks-mode">quirks mode</a> and the <a href="#content-type" title="Content-Type">Content-Type metadata</a> of the external - resource is not a supported style sheet type, the user agent must - instead assume it to be <code title="">text/css</code>.</p> + <a href="#quirks-mode">quirks mode</a>, has the <a href="#same-origin">same origin</a> as the + <a href="#url">URL</a> of the external resource<!-- CVE-2010-0654 -->, and + the <a href="#content-type" title="Content-Type">Content-Type metadata</a> of the + external resource is not a supported style sheet type, the user + agent must instead assume it to be <code title="">text/css</code>.</p> </div><h5 id="link-type-sidebar"><span class="secno">4.12.4.15 </span>Link type "<dfn title="rel-sidebar"><code>sidebar</code></dfn>"</h5><p class="XXX annotation"><b>Status: </b><i>Last call for comments</i><p>The <code title="rel-sidebar"><a href="#link-type-sidebar">sidebar</a></code> keyword may be used with <code><a href="#the-link-element">link</a></code>, <code><a href="#the-a-element">a</a></code>, and <code><a href="#the-area-element">area</a></code>
Received on Thursday, 26 August 2010 01:47:08 UTC