- From: Ian Hickson via cvs-syncmail <cvsmail@w3.org>
- Date: Wed, 20 Jan 2010 02:17:39 +0000
- To: public-html-commits@w3.org
Update of /sources/public/html5/spec
In directory hutz:/tmp/cvs-serv16123
Modified Files:
Overview.html
Log Message:
Make text/html-sandboxed sandbox plugins also, since plugins don't honour UA origin determinations. (whatwg r4618)
Index: Overview.html
===================================================================
RCS file: /sources/public/html5/spec/Overview.html,v
retrieving revision 1.3678
retrieving revision 1.3679
diff -u -d -r1.3678 -r1.3679
--- Overview.html 20 Jan 2010 01:08:32 -0000 1.3678
+++ Overview.html 20 Jan 2010 02:17:35 -0000 1.3679
@@ -17310,17 +17310,25 @@
content</a>, any plugins instantiated for the element must be
removed, and the <code><a href="#the-embed-element">embed</a></code> element represents nothing.</p>
- <p id="sandboxPluginEmbed">If the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing
- context flag</a> was set on the <a href="#browsing-context">browsing context</a> for
- which the <code><a href="#the-embed-element">embed</a></code> element's <code>Document</code> is the
- <a href="#active-document">active document</a> when that <code>Document</code> was
- created, then the user agent must render the <code><a href="#the-embed-element">embed</a></code>
- element in a manner that conveys that the <a href="#plugin">plugin</a> was
+ <p id="sandboxPluginEmbed">If either:
+
+ <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was
+ set on the <a href="#browsing-context">browsing context</a> for which the
+ <code><a href="#the-embed-element">embed</a></code> element's <code>Document</code> is the
+ <a href="#active-document">active document</a> when that <code>Document</code> was
+ created, or</li>
+
+ <li>the <code><a href="#the-embed-element">embed</a></code> element's <code>Document</code> was
+ parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type
+ sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is
+ <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li>
+
+ </ul><p>...then the user agent must render the <code><a href="#the-embed-element">embed</a></code> element
+ in a manner that conveys that the <a href="#plugin">plugin</a> was
disabled. The user agent may offer the user the option to override
the sandbox and instantiate the <a href="#plugin">plugin</a> anyway; if the
user invokes such an option, the user agent must act as if the
- <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was not set for
- the purposes of this element.</p>
+ conditions above did not apply for the purposes of this element.</p>
<p class="warning">Plugins are disabled in sandboxed browsing
contexts because they might not honor the restrictions imposed by
@@ -17335,7 +17343,8 @@
<ul class="brief"><li>The element is <a href="#in-a-document" title="in a document">in a <code>Document</code></a>.</li>
<li>The element's <code>Document</code> is <a href="#fully-active">fully active</a>.</li>
<li>The element has either a <code title="attr-embed-src"><a href="#attr-embed-src">src</a></code> attribute set or a <code title="attr-embed-type"><a href="#attr-embed-type">type</a></code> attribute set (or both).</li>
- <li>The element is not in a <code>Document</code> whose <a href="#browsing-context">browsing context</a> had the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> set when the <code>Document</code> was created.</li>
+ <li>The element is not in a <code>Document</code> whose <a href="#browsing-context">browsing context</a> had the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> set when the <code>Document</code> was created (unless this has been overrriden as described above).</li>
+ <li>The element's <code>Document</code> was not parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> (unless this has been overrriden as described above).</li>
<li>The element is not a descendant of a <a href="#media-element">media element</a>.</li>
<li>The element is not a descendant of an <code><a href="#the-object-element">object</a></code> element that is not showing its <a href="#fallback-content">fallback content</a>.</li>
</ul><p>Whenever an <code><a href="#the-embed-element">embed</a></code> element that was not <a href="#concept-embed-active" title="concept-embed-active">potentially active</a> becomes <a href="#concept-embed-active" title="concept-embed-active">potentially active</a>, and whenever
@@ -17928,12 +17937,21 @@
<a href="#plugin">plugin</a>. The <a href="#plugin">plugin</a> is not a nested
<a href="#browsing-context">browsing context</a>.</p>
- <p id="sandboxPluginObject">If the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing
- context flag</a> was set on the <code><a href="#the-object-element">object</a></code> element's
- <code>Document</code>'s <a href="#browsing-context">browsing context</a> when the
- <code>Document</code> was created, then the steps above must always
- act as if they had failed to find a <a href="#plugin">plugin</a>, even if one
- would otherwise have been used.</p>
+ <p id="sandboxPluginObject">If either:</p>
+
+ <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was
+ set on the <code><a href="#the-object-element">object</a></code> element's <code>Document</code>'s
+ <a href="#browsing-context">browsing context</a> when the <code>Document</code> was
+ created, or</li>
+
+ <li>the <code><a href="#the-object-element">object</a></code> element's <code>Document</code> was
+ parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type
+ sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is
+ <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li>
+
+ </ul><p>...then the steps above must always act as if they had failed to
+ find a <a href="#plugin">plugin</a>, even if one would otherwise have been
+ used.</p>
<p class="note">The above algorithm is independent of CSS properties
(including 'display', 'overflow', and 'visibility'). For example, it
@@ -62578,7 +62596,10 @@
<a href="#fully-active">fully active</a>, and when the element's
<code>Document</code>'s <a href="#browsing-context">browsing context</a> had its
<a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> when that
- <code>Document</code> was created, and when the element has an
+ <code>Document</code> was created, and when the element's
+ <code>Document</code> was parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type sniffing">sniffed type</a> as determined
+ during <a href="#navigate" title="navigate">navigation</a> is
+ <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code>, and when the element has an
ancestor <a href="#media-element">media element</a>, and when the element has an
ancestor <code><a href="#the-object-element">object</a></code> element that is <em>not</em> showing
its <a href="#fallback-content">fallback content</a>, and when no Java Language runtime
Received on Wednesday, 20 January 2010 02:17:41 UTC