W3C home > Mailing lists > Public > public-webappsec@w3.org > October 2012

Re: CSP and inline styles

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Tue, 23 Oct 2012 11:46:46 -0400
Message-ID: <5086BBE6.2010802@mit.edu>
To: Adam Barth <w3c@adambarth.com>
CC: public-webappsec@w3.org
On 10/23/12 11:36 AM, Adam Barth wrote:
> The underlying issue appears to be that we have different processing
> models in our heads for how the style attribute and the CSSOM produce
> style information for elements.

Yep.  Possibly because the actual processing model is not defined in any 
specs and is therefore implementation-dependent...

> From reading the above, it appears
> that your model is that the CSSOM is just a fancy way of generating a
> string that gets stored in the style attribute.

More precisely, my model is that the CSSOM always modifies the style 
attribute in addition to changing the state of the CSSOM.  And that 
changing the attribute always changes the state of the CSSOM.  That is, 
the string value of the attribute and the CSSOM are always in sync.

> It's clear from <http://html.spec.whatwg.org/#the-style-attribute>
> that mutating the CSSStyleDeclaration causes the style attribute's
> value to change, but it's not clear whether the computed style for the
> element flows directly from the CSSStyleDeclaration or via the style
> attribute.  In your understanding, it's the latter whereas my view is
> the former.

In my understanding, computed style comes from the CSSStyleDeclaration. 
  The problem is one of telling where the CSSStyleDeclaration "came from"...

> In any case, hooking into the processing model at CSS 2.1 section
> 6.4.3 does seem like a cleaner approach.  I'm happy to make that
> change.

Sounds great.  ;)

-Boris
Received on Tuesday, 23 October 2012 15:47:25 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 23 October 2012 15:47:25 GMT