W3C home > Mailing lists > Public > www-style@w3.org > October 2012

Re: [cssom] Make CSSStyleSheet constructable

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Mon, 22 Oct 2012 17:13:25 -0400
Message-ID: <5085B6F5.2080509@mit.edu>
To: "Tab Atkins Jr." <jackalmage@gmail.com>
CC: Dimitri Glazkov <dglazkov@google.com>, "www-style@w3.org" <www-style@w3.org>, Tony Ross <tross@microsoft.com>
On 10/22/12 5:00 PM, Tab Atkins Jr. wrote:
> On Mon, Oct 22, 2012 at 1:32 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
>> My main concern with making CSSStyleSheet objects directly constructable is
>> that it seems like it creates various footguns, in terms of specification,
>> implementation, and use.  Most importantly, it lets you share a single
>> CSSStyleSheet across multiple pages, including pages that are not
>> same-origin due to document.domain changes....  So if there is a way to
>> address the use case without creating all the same complexity, I would be in
>> favor of it.
>
> Stylesheets leak most of their information cross-domain anyway - I
> think the only reason they're really still restricted is because of
> comments, which aren't observable except through examining cssText
> directly.

I'm not worried about reading the CSSOM here. I'm more concerned about 
script in one origin changing the sheet and affecting styles applied in 
another origin.

(Note that Gecko drops comments from the CSSOM, by the way.)

> Can we just specifically neuter this?  Say that constructed
> stylesheets explicitly drop the contents of comments (you need to
> preserve the existence of them, unfortunately)

Why?  Gecko certainly doesn't right now.

-Boris
Received on Monday, 22 October 2012 21:13:55 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 17:21:01 GMT