W3C home > Mailing lists > Public > public-webappsec@w3.org > May 2013

Re: [filter-effects][css-masking] Move security model for resources to CSP

From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 31 May 2013 11:46:28 +1200
Message-ID: <CAOp6jLaM-40MwR-rzSOpB+CuztcdSb4qhAZcTK6cqGSmjsyYJQ@mail.gmail.com>
To: Dirk Schulze <dschulze@adobe.com>
Cc: Anne van Kesteren <annevk@annevk.nl>, Bjoern Hoehrmann <derhoermi@gmx.net>, "public-fx@w3.org" <public-fx@w3.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Daniel Holbert <dholbert@mozilla.com>, Philip Rogers <pdr@google.com>
On Fri, May 31, 2013 at 2:32 AM, Dirk Schulze <dschulze@adobe.com> wrote:

> Daniel Holbert asked me an interesting question yesterday: Do external SVG
> resources (filter, mask, clip-path) behave like stylesheets? And I think
> they do. With all the restriction in place that you suggested earlier (no
> secondary resource load of the external SVG resource), is there a strong
> need to handle SVG resources differently than CSS stylesheets? As far as I
> know CSS stylesheets do not follow strict cross origin restrictions. Why
> would SVG resources need to do it?

You can address individual XML elements of an arbitrary SVG document using
SVG resource references. You can't do anything like that with a CSS style
sheet. I suppose you can try to load the style sheet and add random stuff
to your document to try to figure out what the style rules are, but that
seems less interesting.

Maybe you're right, but it requires a lot of careful thought by people with
the right mentality before I'd be comfortable allowing cross-origin
references. (We've been stuck with cross-origin CSS loads from the
beginning, and have had to deal with some ugly fallout from that over the

q“qIqfq qyqoquq qlqoqvqeq qtqhqoqsqeq qwqhqoq qlqoqvqeq qyqoquq,q qwqhqaqtq
qcqrqeqdqiqtq qiqsq qtqhqaqtq qtqoq qyqoquq?q qEqvqeqnq qsqiqnqnqeqrqsq
qlqoqvqeq qtqhqoqsqeq qwqhqoq qlqoqvqeq qtqhqeqmq.q qAqnqdq qiqfq qyqoquq
qdqoq qgqoqoqdq qtqoq qtqhqoqsqeq qwqhqoq qaqrqeq qgqoqoqdq qtqoq qyqoquq,q
qwqhqaqtq qcqrqeqdqiqtq qiqsq qtqhqaqtq qtqoq qyqoquq?q qEqvqeqnq
qsqiqnqnqeqrqsq qdqoq qtqhqaqtq.q"
Received on Thursday, 30 May 2013 23:46:58 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:33 UTC