- From: Matthieu Dubet via GitHub <sysbot+gh@w3.org>
- Date: Wed, 07 Feb 2024 22:41:22 +0000
- To: public-css-archive@w3.org
We already have this kind of "not obvious for author" exponential expansion with `--var`. The css-variables spec warns about this, maybe the css-nesting spec could have a similar paragraph. > To avoid this sort of attack, UAs must impose a UA-defined limit on the allowed length of the token stream that a [var()](https://drafts.csswg.org/css-variables-2/#funcdef-var) function expands into. If a var() would expand into a longer token stream than this limit, it instead makes the property it’s expanding into [invalid at computed-value time](https://drafts.csswg.org/css-variables-2/#invalid-at-computed-value-time). https://drafts.csswg.org/css-variables-2/#long-variables -- GitHub Notification of comment by mdubet Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/2881#issuecomment-1933055570 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 7 February 2024 22:41:25 UTC