- From: arturjanc via GitHub <sysbot+gh@w3.org>
- Date: Thu, 24 Nov 2022 14:51:12 +0000
- To: public-css-archive@w3.org
For other folks interested in this issue, we recently had a discussion about a safe path forward for `attr()` in https://github.com/web-platform-tests/interop/issues/86#issuecomment-1316955804 and the comments above. As a brief summary, IMHO preventing the use of `attr()` inside `url()` by default but allowing it via a per-element opt-in (e.g. requiring explciitly marking certain elements/attributes as visible to CSS) might be a reasonable balance between usability and security. We'd still have issues with other attribute types (like the one mentioned directly above in https://github.com/w3c/csswg-drafts/issues/5092#issuecomment-636452209), but they seem less likely to cause security problems in practice, so I'm less worried about these. -- GitHub Notification of comment by arturjanc Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/5092#issuecomment-1326551868 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Thursday, 24 November 2022 14:51:14 UTC