Re: [webcomponents] [Shadow]: Add "closed" flag to createShadowRoot (bugzilla: 20144) (#100)

The major concern I have with this feature is that there has been no discussion of what goals this feature needs to achieve. Statements about replacing iframes without a clear enumeration of the reasons this is needed, are useless.

This feature has no rationale but has some very serious implications and should therefore not exist.

Why is this solution worse than iframes from a perspective of auditing?

1) with iframes one can detect their existence and therefore flag them as unanalyzed areas
2) using systems like Selenium, one can inject code into them that allows analysis to occur inside the iframe using message passing as is done by the axe-core library

What mechanism will be available to do this on closed shadow DOMs?



---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/100#issuecomment-161615458