W3C home > Mailing lists > Public > public-webapps@w3.org > July to September 2010

Re: XBL2

From: Adam Barth <w3c@adambarth.com>
Date: Fri, 3 Sep 2010 16:30:22 -0700
Message-ID: <AANLkTi=hvKKSCaSK8si+HytoMbF8qiyb6o52Y3pvHaRX@mail.gmail.com>
To: Ian Hickson <ian@hixie.ch>
Cc: public-webapps@w3.org, hyatt@apple.com
I chatted with Ian on IRC.  I misunderstood the layer at which XBL
operates.  XBL operates on already-parsed DOM trees, not on unparsed
characters.

Adam


On Fri, Sep 3, 2010 at 2:17 PM, Adam Barth <w3c@adambarth.com> wrote:
> From skimming the document, it wasn't immediately clear to me how to
> instantiate one of these object.  From a security point of view, it
> would be desirable if the content that gets filled into the template
> where syntactically separate from the template itself.  That would
> help mitigate cross-site scripting in much the same way that prepared
> SQL statements help mitigate SQL injection.
>
> Adam
>
>
> On Thu, Sep 2, 2010 at 6:23 PM, Ian Hickson <ian@hixie.ch> wrote:
>>
>> Since XBL2 wasn't getting much traction, I've taken an axe to the spec and
>> made a number of changes to the spec based on some discussions with some
>> browser vendors:
>>
>>   http://dev.w3.org/2006/xbl2/Overview.html
>>
>> The main changes are simplification: I've dropped namespace support, made
>> it part of HTML rather than its own language, dropped <style> and <script>
>> in favour of HTML equivalents, dropped all the <handler> syntactic sugar
>> (and redirected event forwarding to internal object instead), dropped
>> <preload>, dropped mentions of XForms and XML Events, and so on. I've
>> updated all the examples to use the new syntax, so if you're curious about
>> the differences, comparing the examples in the spec above to those in the
>> TR version is probably a good way to get an idea of what I did.
>>
>> If this ends up being more successful than the previous work on this
>> specification, I'll have to merge it with the HTML spec to more properly
>> define how it works. Right now it leaves a lot of the detail a bit vague
>> (e.g. integration with the event loop, the parser, authoring conformance
>> definitions, etc). If this happens, I don't yet know how much this will
>> lend itself to being extracted back out into a separate module (for
>> publication by this working group), versus being just published as a core
>> part of the HTML spec, but I will be happy to update the group on this
>> matter as it becomes clearer.
>>
>> I don't think the draft above would be suitable for publication as a TR/
>> draft, because of the aforementioned rough edges. I mostly just wanted to
>> provide this for discussion, to see whether people considered this a move
>> in a good direction or a significant step backwards.
>>
>> --
>> Ian Hickson               U+1047E                )\._.,--....,'``.    fL
>> http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
>> Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'
>>
>>
>
Received on Friday, 3 September 2010 23:31:34 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 18:49:40 GMT