- From: jsalowey via GitHub <sysbot+gh@w3.org>
- Date: Sat, 26 Sep 2020 23:15:01 +0000
- To: public-css-archive@w3.org
jsalowey has just created a new issue for https://github.com/w3c/csswg-drafts: == [css-color-4] Security: handling of color-profiles == I've been assigned to security review this document. I have some concerns with the handling of [color profiles](https://drafts.csswg.org/css-color-4/#at-profile) and how they might introduce security and privacy risks. My understanding of them is incomplete. 1. Are the .icc files listed in the color-profile meant to be retrieved and parsed in real time? If so there is a potential risk that these requests could be used to track a user or deliver a malicious payload. 2. Are .icc files something that browsers already parse or is this a file-format that is new to them? Can these files contain any "scripts" or "code"? What are the ways an implementation can mitigate any risks associated with handling this new file type? 3. Can a script determine if the profile was used or if a fallback was used? If so it seems this could be used in fingerprinting 4. How would color-profiles interact with content security policy? Do you envision any special treatment of these requests by content security policy? Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/5552 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Saturday, 26 September 2020 23:15:03 UTC