Re: exposing underlining mechanism for IME?

On Sat, Nov 07, 2015 at 08:10:19PM +0100, Johannes Wilm wrote:
> The markers as we have them today are not to be found in the DOm, I believe.

Ok.

> On Sat, Nov 7, 2015 at 7:43 PM, David Young <dyoung@pobox.com> wrote:
> > Seems like an editor can enclose the range in a <span> styled
> > 'text-decoration: underline'?
> 
> Yes, but at that stage it is no longer a partial text node.

Is that a problem?

> > I think the problem you're concerned about is browser fingerprinting?
> > Couldn't you also use timing of addCompositionMarker() to fingerprint?
> >
> 
> Timing because it takes longer to draw a thick black line rather than a
> yellow background (for example)? Or how do you mean?

Yes, that's a good example.

> > Can't you render HTML to a Canvas, serialize the Canvas, and look
> > for the signature of an IME marker in it?  I suspect that there's an
> > infinite regress of issues here, and we're going to be stuck if we have
> > to quiet every security concern before we've built a single satisfactory
> > editor.
> >
> 
> Have you been able to get access to information about the IME using
> JavaScript?
> 
> This proposal would only concern contenteditable, not canvas or other
> elements. And because the markers is not part of the DOM, I don't think
> there is any way to get it into a canvas, is there?

You're right.  There's not a way to get at the marker pixels that I can
see.  Details:

https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API/Drawing_DOM_objects_into_a_canvas

Dave

-- 
David Young
dyoung@pobox.com    Urbana, IL    (217) 721-9981

Received on Thursday, 12 November 2015 00:40:30 UTC