The changes since 5.1 are generally low risk, with many dealing with non-security aspects of the spec, such as adding attributes or making other minor changes in element behavior, or -- even better -- removing obsolete features. Of the more interesting changes, I took a closer look at a dozen or so of those which seemed more likely to have a security impact.

In general, I didn't find anything particularly problematic; there are a few opportunities for clarifying the text around some security-relevant features and I filed a couple of minor issues (#951, #952, and webappsec-secure-contexts/#49).

I was also happy to see several security-positive hardening changes such as treating data: as separate origin [2], restricting navigation of sandbox frames [3], and various integrations with CSP.

As a meta-note, one thing that struck me as a reviewer without much background with the spec is that there is a fairly wide variety when it comes to Security sections for individual features. In some cases, the security discussion is extensive [4], but in others important security checks seem to be defined without much explanation. Similarly, some commits introduce potentially security-sensitive changes without any relevant discussion in the Github issue. I assume this is not a surprise to anyone here, but perhaps this is something that could be improved in the future.

Good luck getting to CR!

Cheers,

-Artur

[1] https://docs.google.com/document/d/1y0Jqe7I9w9VTzOGabeSIowQYqdTA0TSCn3ePQBnZe_0/edit

[2] https://github.com/w3c/html/commit/1f582bb098666f82b53e0a338d5709a320088ac9

[3] https://github.com/w3c/html/commit/54a634c3bbe37f216b9b6ff232381aacc7e82772

[4] https://www.w3.org/TR/html52/single-page.html#security-and-privacy

On Fri, Jun 2, 2017 at 12:40 PM, Léonie Watson <tink@tink.uk> wrote:

+ public-html@w3.org

Thank you all for helping with this.

Would it be possible for the review to be completed next week? We had originally put the 5.2 spec out for wide review by 26th May, with a view to being in CR (Candidate Recommendation) by 20th June [1]. That meant freezing the spec today so we could go to the WG to ask for their consent to make the transition.

We want a security review, but we also want to minimise the impact to our timeline. Even if the review is completed next week, we're still looking at a two week delay (plus any time needed to respond to any issues you might file).

Anything you can do to help us would be greatly appreciated.

Thanks
Léonie
--
@LeonieWatson tink.uk Carpe diem