Re: [csswg-drafts] [css-values] Security concerns regarding attr() (#5092)

> Ooh, okay, I was assuming that a per-token tainting was too complicated, but if instead it's _easier_, I'm definitely fine with that.

No, it is definitely substantially more complicated. (May vary between implementations).

However, per-value tainting means stuff will stop working just because you add indirection via a custom property:

```
background: image("bg.gif", attr(my-attr-green)); /* works */
--img: "bg.gif", attr(my-attr-green);
background: image(var(--img)); /* does not work */
```
> at the moment, spec says entire value is tainted if any part has attr.

No, it doesn't. But there seems to be agreement that it does. Let's clarify the spec _that_ way, then.

-- 
GitHub Notification of comment by andruud
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/5092#issuecomment-2378608877 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 27 September 2024 07:35:27 UTC