Re: [csswg-drafts] [selectors][css-values] Hide "sensitive" attributes from CSS (#5136)

Every attack relies on [`<url>`](https://drafts.csswg.org/css-values/#urls). Can other uses of `attr()` be considered safe and therefore need no restriction at all? 

-- 
GitHub Notification of comment by Crissov
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/5136#issuecomment-639257245 using your GitHub account

Received on Friday, 5 June 2020 04:51:39 UTC