- From: Elliott Sprehn <esprehn@chromium.org>
- Date: Wed, 21 Aug 2013 22:41:58 -0700
- To: Ian Hickson <ian@hixie.ch>
- Cc: Matt Falkenhagen <falken@chromium.org>, WHATWG <whatwg@lists.whatwg.org>, "Tab Atkins Jr." <jackalmage@gmail.com>
On Wed, Aug 21, 2013 at 3:58 PM, Ian Hickson <ian@hixie.ch> wrote: > ... > > > > It's true that for seamless iframes we could change that, but the > > > usual use case for seamless iframes is something like blog comments, > > > so it's not clear that there's a use case for dialogs there. If there > > > was to be one, we could consider it. It sounds like a lot of work to > > > do if there's not a compelling need though. > > > > Hm, I was given to understand that it *was* intended that dialogs be > > able to escape iframes through some mechanism. > > That isn't specced currently. I'm not 100% I understand how it would work > (I guess it would need a lot of infrastructure from CSS?), but I'm happy > to do it if there's demand and if the CSS side is figured out. > > Matt and I discussed this and I don't think we need it anymore. I've also discussed it with security folks and they're not super comfortable allowing a nested iframe to show arbitrary content over the main frame. Specifically this gives non-sandboxes iframes superpowers they didn't have before (so we'd need a special new attribute) and we'd need to show info bars to notify the user of the origin of the dialog... even then it's scary because the content seen under the ::backdrop is from a different origin than the dialog itself. - E
Received on Thursday, 22 August 2013 05:43:20 UTC