- From: Anne van Kesteren <annevk@annevk.nl>
- Date: Thu, 27 Jun 2013 14:49:53 +0100
- To: Ian Hickson <ian@hixie.ch>
- Cc: Boris Zbarsky <bzbarsky@mit.edu>, Adam Barth <w3c@adambarth.com>, "Edward O'Connor" <eoconnor@apple.com>, Travis Leithead <Travis.Leithead@microsoft.com>, www-archive <www-archive@w3.org>
On Tue, Jun 25, 2013 at 7:35 PM, Ian Hickson <ian@hixie.ch> wrote: > As long as it's not exposed to script, we probably can. Workers, for > instance, keep track of Documents internally. Maybe. If CSP gets an API to modify the policy after the fact you might run into racing issues. So you'd need the policy to be static in some way and pushed over every now and then. > That state is currently managed via a Document, no? Yeah, in HTML fetch it mostly is (safe for the overrides, which we'll need to keep either way). I tried to abstract them into parameters, but maybe that's not the best approach. >> 3) If we merge CSP and Fetch by having a CSP parameter to fetch, we can >> handle the load images directly from disk if the URL has been fetched >> for the Document before via this fetch group. HTML, CSS, SVG, et al >> would fetch images using the 'image-src' CSP parameter and the rest >> would follow automatically. > > Note that the "list of available images" is allowed to be copied from doc > to doc, it's not really scoped to the "fetch group". Okay. So maybe instead what we need to do is have HTML define some kind of "image fetch" thingie that CS, SVG et al can use? -- http://annevankesteren.nl/
Received on Thursday, 27 June 2013 13:50:24 UTC