Re: [csswg-drafts] [css-mediaqueries] Should prefers-color-scheme in SVG images be context-dependent? (#7213)

The CSS Working Group just discussed `[css-mediaqueries] Should prefers-color-scheme in SVG images be context-dependent?`, and agreed to the following:

* `RESOLVED: Have prefered-color-scheme reflect 'color-scheme' on the embedding element in the embedding document, to the extent acceptable from security standpoint (pending security review)`

<details><summary>The full IRC log of that discussion</summary>
&lt;fantasai> topic: [css-mediaqueries] Should prefers-color-scheme in SVG images be context-dependent?<br>
&lt;fantasai> github: https://github.com/w3c/csswg-drafts/issues/7213<br>
&lt;fantasai> emilio: We got an interesting bug report in Firefox<br>
&lt;fantasai> emilio: When you have a Firefox theme that's dark, but OS theme is light<br>
&lt;fantasai> emilio: sites can't choose a reasonable favicon for dark mode<br>
&lt;fantasai> emilio: Suggestion is to make preferred-color-scheme for SVG images reflect the used color scheme<br>
&lt;fantasai> emilio: Then could have light+dark icons anywhere in your page, and then as long as your parent has the correct color-scheme will display correctly<br>
&lt;fantasai> emilio: Maybe worth making this more general<br>
&lt;fantasai> emilio: Tab seemed to have some reservations<br>
&lt;fantasai> TabAtkins: This makes a cross-origin communication bit, and we try to restrict those<br>
&lt;fantasai> TabAtkins: use case makes sense<br>
&lt;fantasai> TabAtkins: Just one more bit that you can use to talk to an iframe, and every bit counts<br>
&lt;fantasai> TabAtkins: but if that's considered not too much of a problem, then I'm fine with it<br>
&lt;fantasai> emilio: It's a communication channel in the sense that the SVG could request a different image or something<br>
&lt;fantasai> emilio: but SVG images don't run script<br>
&lt;fantasai> emilio: I think Chrome did something like this for iframes, don't know the details of that<br>
&lt;futhark> q+<br>
&lt;fantasai> emilio: If your iframe is in color-scheme: ? then you force a light background<br>
&lt;fantasai> futhark: Behavior for ?? is specified in the spec, that you set the background of the iframe if 'color-scheme' doesn't match parent<br>
&lt;fantasai> futhark: so you don't wind up with black on black or white on white<br>
&lt;TabAtkins> s/??/iframes with different color scheme than parent document/<br>
&lt;fantasai> futhark: Wanted to ask, has anyone asked for similar functionality for iframe?<br>
&lt;emilio> q+<br>
&lt;fantasai> futhark: or will there be other cases?<br>
&lt;Rossen_> ack futhark<br>
&lt;fantasai> futhark: other than SVG<br>
&lt;Rossen_> ack fantasai<br>
&lt;Zakim> fantasai, you wanted to ask why not restrict cross-origin<br>
&lt;fantasai> fantasai: If the concern is cross-origin, why not restrict to same-origin<br>
&lt;fantasai> emilio: Possible, but maybe awkward<br>
&lt;fantasai> emilio: wrt Rune's question, we actually do that for some frames<br>
&lt;fantasai> emilio: e.g. for extension popups in Firefox, they're just iframes inside a popup<br>
&lt;fantasai> emilio: we make those inherit the color scheme of Firefox in a similar fashion<br>
&lt;fantasai> emilio: so we already have this code to make it work for iframes<br>
&lt;fantasai> futhark: We do something similar for &lt;select> popups in Chrome<br>
&lt;fantasai> futhark: If you have &lt;select> with a color scheme, that affects the drop-down render<br>
&lt;fantasai> emilio: This seems generally a useful thing then<br>
&lt;fantasai> emilio: Main question is whether it's reasonable, given the issue Tab mentioned<br>
&lt;fantasai> emilio: I'm not sure I'm the right person to make that assessment<br>
&lt;fantasai> emilio: What about we ask people in privacy/security what they think about this?<br>
&lt;fantasai> emilio: If we accept it, then we can consider doing iframes as well<br>
&lt;fantasai> Rossen_: seems like a reasonable path forward<br>
&lt;fantasai> Rossen_: I think general consensus of the group leans towards the proposal<br>
&lt;fantasai> Rossen_: pending feedback from Security folks<br>
&lt;fantasai> Rossen_: So my proposal is to end the discussion here, and then get back to it as we gather more information<br>
&lt;TabAtkins> Always useful to resolve, if for no other reason than to have a neat conclusion easy to read at the end<br>
&lt;fantasai> fantasai: Could resolve that we want to do this, if reasonable from security standpoint<br>
&lt;fantasai> Rossen_: Any objection to record this as consensus of group?<br>
&lt;fantasai> PROPOSAL: Have prefered-color-scheme reflect 'color-scheme' on the element in the embedding document, to the extent acceptable from security standpoint<br>
&lt;fantasai> RESOLVED: Have prefered-color-scheme reflect 'color-scheme' on the embedding element in the embedding document, to the extent acceptable from security standpoint (pending security review)<br>
</details>


-- 
GitHub Notification of comment by css-meeting-bot
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/7213#issuecomment-1104138058 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 20 April 2022 16:26:45 UTC