Re: [cssom] Make CSSStyleSheet constructable

On 10/22/12 5:00 PM, Tab Atkins Jr. wrote:
> On Mon, Oct 22, 2012 at 1:32 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
>> My main concern with making CSSStyleSheet objects directly constructable is
>> that it seems like it creates various footguns, in terms of specification,
>> implementation, and use.  Most importantly, it lets you share a single
>> CSSStyleSheet across multiple pages, including pages that are not
>> same-origin due to document.domain changes....  So if there is a way to
>> address the use case without creating all the same complexity, I would be in
>> favor of it.
>
> Stylesheets leak most of their information cross-domain anyway - I
> think the only reason they're really still restricted is because of
> comments, which aren't observable except through examining cssText
> directly.

I'm not worried about reading the CSSOM here. I'm more concerned about 
script in one origin changing the sheet and affecting styles applied in 
another origin.

(Note that Gecko drops comments from the CSSOM, by the way.)

> Can we just specifically neuter this?  Say that constructed
> stylesheets explicitly drop the contents of comments (you need to
> preserve the existence of them, unfortunately)

Why?  Gecko certainly doesn't right now.

-Boris

Received on Monday, 22 October 2012 21:13:55 UTC